{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Data Grid is now available.\n \nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.\n \nData Grid 8.3.0 replaces Data Grid 8.2.3 and includes bug fixes and enhancements. Find out more about Data Grid 8.3.0 in the Release Notes[3].\n\nSecurity Fix(es):\n\n* XStream: remote command execution attack by manipulating the processed input stream (CVE-2021-29505)\n\n* xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl (CVE-2021-39139)\n\n* xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* (CVE-2021-39141)\n\n* xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* (CVE-2021-39144)\n\n* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39145)\n\n* xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39146)\n\n* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration (CVE-2021-39147)\n\n* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator (CVE-2021-39148)\n\n* xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* (CVE-2021-39149)\n\n* xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* (CVE-2021-39150)\n\n* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration (CVE-2021-39151)\n\n* xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData (CVE-2021-39152)\n\n* xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl (CVE-2021-39153)\n\n* xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue (CVE-2021-39154)\n\n* wildfly-elytron: possible timing attack in ScramServer (CVE-2021-3642)\n\n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler (CVE-2021-39140)\n\n* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0520",
        "url": "https://access.redhat.com/errata/RHSA-2022:0520"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=data.grid\u0026version=8.3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=data.grid\u0026version=8.3"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.3/html-single/red_hat_data_grid_8.3_release_notes/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_data_grid/8.3/html-single/red_hat_data_grid_8.3_release_notes/"
      },
      {
        "category": "external",
        "summary": "1966735",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1966735"
      },
      {
        "category": "external",
        "summary": "1981407",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981407"
      },
      {
        "category": "external",
        "summary": "1997763",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997763"
      },
      {
        "category": "external",
        "summary": "1997765",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997765"
      },
      {
        "category": "external",
        "summary": "1997769",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997769"
      },
      {
        "category": "external",
        "summary": "1997772",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997772"
      },
      {
        "category": "external",
        "summary": "1997775",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997775"
      },
      {
        "category": "external",
        "summary": "1997777",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997777"
      },
      {
        "category": "external",
        "summary": "1997779",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997779"
      },
      {
        "category": "external",
        "summary": "1997781",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997781"
      },
      {
        "category": "external",
        "summary": "1997784",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997784"
      },
      {
        "category": "external",
        "summary": "1997786",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997786"
      },
      {
        "category": "external",
        "summary": "1997791",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997791"
      },
      {
        "category": "external",
        "summary": "1997793",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997793"
      },
      {
        "category": "external",
        "summary": "1997795",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997795"
      },
      {
        "category": "external",
        "summary": "1997801",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997801"
      },
      {
        "category": "external",
        "summary": "2004133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
      },
      {
        "category": "external",
        "summary": "2004135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
      },
      {
        "category": "external",
        "summary": "2031958",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031958"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0520.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Data Grid 8.3.0 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:31:42+00:00",
      "generator": {
        "date": "2026-05-14T22:31:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2022:0520",
      "initial_release_date": "2022-02-14T13:06:09+00:00",
      "revision_history": [
        {
          "date": "2022-02-14T13:06:09+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-14T13:06:09+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:31:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Data Grid 8.3.0",
                "product": {
                  "name": "Red Hat Data Grid 8.3.0",
                  "product_id": "Red Hat Data Grid 8.3.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_data_grid:8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Data Grid"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3642",
      "cwe": {
        "id": "CWE-203",
        "name": "Observable Discrepancy"
      },
      "discovery_date": "2021-06-30T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1981407"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-elytron: possible timing attack in ScramServer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3642"
        },
        {
          "category": "external",
          "summary": "RHBZ#1981407",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981407"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3642",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3642"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3642",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3642"
        }
      ],
      "release_date": "2021-06-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "wildfly-elytron: possible timing attack in ScramServer"
    },
    {
      "cve": "CVE-2021-29505",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-05-28T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1966735"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "XStream: remote command execution attack by manipulating the processed input stream",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\n\nCodeReady Studio 12 ships a version of xstream that is affected by this flaw as a transitive dependency for the Wise framework plugin. However, the vulnerable code is not called, so this flaw has been marked as Low severity for CodeReady Studio 12.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-29505"
        },
        {
          "category": "external",
          "summary": "RHBZ#1966735",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1966735"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-29505",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-29505"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-29505",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29505"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-7chv-rrw6-w6fc"
        },
        {
          "category": "external",
          "summary": "https://x-stream.github.io/CVE-2021-29505.html",
          "url": "https://x-stream.github.io/CVE-2021-29505.html"
        }
      ],
      "release_date": "2021-05-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        },
        {
          "category": "workaround",
          "details": "Depending on the version of XStream used there are various usage patterns that mitigate this flaw, though we would strongly recommend using the allow list approach if at all possible as there are likely more class combinations the deny list approach may not address.\n\nAllow list approach\n```java\nXStream xstream = new XStream();\nXStream.setupDefaultSecurity(xstream);\nxstream.allowTypesByWildcard(new String[] {\"com.misc.classname\"})\n```\nDeny list for XStream 1.4.16 (this should also address some previous flaws found in 1.4.7 - \u003e 1.4.15) \n```java\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\.Lazy(?:Search)?Enumeration.*\", \"(?:java|sun)\\\\.rmi\\\\..*\" });\n```\n\nDeny list for XStream 1.4.15\n```java\nxstream.denyTypes(new String[]{ \"sun.awt.datatransfer.DataTransferer$IndexOrderComparator\", \"sun.swing.SwingLazyValue\", \"com.sun.corba.se.impl.activation.ServerTableEntry\", \"com.sun.tools.javac.processing.JavacProcessingEnvironment$NameProcessIterator\" });\nxstream.denyTypesByRegExp(new String[]{ \".*\\\\$ServiceNameIterator\", \"javafx\\\\.collections\\\\.ObservableList\\\\$.*\", \".*\\\\.bcel\\\\..*\\\\.util\\\\.ClassLoader\" });\nxstream.denyTypeHierarchy(java.io.InputStream.class );\nxstream.denyTypeHierarchy(java.nio.channels.Channel.class );\nxstream.denyTypeHierarchy(javax.activation.DataSource.class );\nxstream.denyTypeHierarchy(javax.sql.rowset.BaseRowSet.class );\n```\n\nDeny list for XStream 1.4.13\n```java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });\n```\n\nDeny list for XStream 1.4.7 -\u003e 1.4.12\n```java\nxstream.denyTypes(new String[]{ \"javax.imageio.ImageIO$ContainsFilter\" });\nxstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class, java.beans.EventHandler.class, java.lang.ProcessBuilder.class, java.lang.Void.class, void.class });\n```\n\nDeny list for versions prior to XStream 1.4.7\n```java\nxstream.registerConverter(new Converter() {\n  public boolean canConvert(Class type) {\n    return type != null \u0026\u0026 (type == java.beans.EventHandler.class || type == java.lang.ProcessBuilder.class || type == java.lang.Void.class || void.class || type.getName().equals(\"javax.imageio.ImageIO$ContainsFilter\") || Proxy.isProxy(type));\n  }\n\n  public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n\n  public void marshal(Object source, HierarchicalStreamWriter writer, MarshallingContext context) {\n    throw new ConversionException(\"Unsupported type due to security reasons.\");\n  }\n}, XStream.PRIORITY_LOW);\n```",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "XStream: remote command execution attack by manipulating the processed input stream"
    },
    {
      "cve": "CVE-2021-37136",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data"
    },
    {
      "cve": "CVE-2021-37137",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way"
    },
    {
      "cve": "CVE-2021-39139",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997763"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39139"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997763",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997763"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39139",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39139"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39139",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39139"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-64xx-cq4q-mf44"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl"
    },
    {
      "cve": "CVE-2021-39140",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997765"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream\u0027s security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "OpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\nThis version of XStream library will be delivered in the future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39140"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997765",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997765"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39140",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39140"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39140",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39140"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-6wf9-jmg9-vxcc"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler"
    },
    {
      "cve": "CVE-2021-39141",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997769"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39141"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997769",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997769"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39141",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39141"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39141",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39141"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-g5w6-mrj7-75h2"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*"
    },
    {
      "cve": "CVE-2021-39144",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997772"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, OCP Jenkins package is not affected by this flaw.\nThis version of XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security\n\nFor more information, please refer to the [Red Hat solution Article](https://access.redhat.com/solutions/7002450) explaining this issue.\n\nOpenShift Logging\u0027s Elasticsearch 6.8.1 using opendistro_security v0.10.1.2 is not affected by the vulnerable code because com.thoughtworks.xstream is only a build-time dependency.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39144"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997772",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997772"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39144",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39144"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39144",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39144"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-j9h8-phrw-h4fh"
        },
        {
          "category": "external",
          "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "exploit_status",
          "date": "2023-03-10T00:00:00+00:00",
          "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
        },
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.*"
    },
    {
      "cve": "CVE-2021-39145",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997775"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39145"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997775",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997775"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39145"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39145",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39145"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-8jrj-525p-826v",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-8jrj-525p-826v"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration"
    },
    {
      "cve": "CVE-2021-39146",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997777"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39146"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997777",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997777"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39146",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39146"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39146",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39146"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-p8pq-r894-fm8f"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue"
    },
    {
      "cve": "CVE-2021-39147",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997779"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39147"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997779",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997779"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39147",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39147"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39147",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39147"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-h7v4-7xg3-hxcc"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration"
    },
    {
      "cve": "CVE-2021-39148",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997781"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39148"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997781",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997781"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39148",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39148"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39148",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39148"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-qrx8-8545-4wg2",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-qrx8-8545-4wg2"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator"
    },
    {
      "cve": "CVE-2021-39149",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997784"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.*",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39149"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997784",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997784"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39149"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-3ccq-5vw3-2p6x"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.*"
    },
    {
      "cve": "CVE-2021-39150",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997786"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. If you rely on XStream\u0027s default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39150"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997786",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997786"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39150",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39150"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39150",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39150"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-cxfm-5m4g-x7xp"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.*"
    },
    {
      "cve": "CVE-2021-39151",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997791"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\n\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39151"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997791",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997791"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39151"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-hph2-m3g5-xxv4"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration"
    },
    {
      "cve": "CVE-2021-39152",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997793"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to request data from internal resources that are not publicly available by manipulating the processed input stream with Java runtime versions 14 to 8. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. If you rely on XStream\u0027s default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\n\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39152"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997793",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997793"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39152",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39152"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39152",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39152"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-xw4p-crpj-vjx2",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-xw4p-crpj-vjx2"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Server-side request forgery (SSRF) via unsafe deserialization of jdk.nashorn.internal.runtime.Source$URLData"
    },
    {
      "cve": "CVE-2021-39153",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997795"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39153"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997795",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997795"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39153"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-2q8x-2p7f-574v"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl"
    },
    {
      "cve": "CVE-2021-39154",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-08-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1997801"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xstream, a simple library used to serialize objects to XML and back again. This flaw allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Users who follow the recommended security framework with a whitelist to limit the types to the minimum required should not be affected. XStream 1.4.18 no longer uses a blacklist by default since it cannot be secured for general purposes.\n\nOpenShift Container Platform (OCP) delivers the Jenkins LTS package with bundled XStream library. Due to JEP-200 [1] and JEP-228 [2] Jenkins projects, the OCP Jenkins package is not affected by this flaw.\nThis version of the XStream library will be delivered in future Jenkins releases.\n\n[1] https://github.com/jenkinsci/jep/blob/master/jep/200/README.adoc\n[2] https://github.com/jenkinsci/jep/blob/master/jep/228/README.adoc#security",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-39154"
        },
        {
          "category": "external",
          "summary": "RHBZ#1997801",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1997801"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-39154",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-39154"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-39154",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39154"
        },
        {
          "category": "external",
          "summary": "https://github.com/x-stream/xstream/security/advisories/GHSA-6w62-hx7r-mw68",
          "url": "https://github.com/x-stream/xstream/security/advisories/GHSA-6w62-hx7r-mw68"
        }
      ],
      "release_date": "2021-08-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue"
    },
    {
      "cve": "CVE-2021-43797",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2021-12-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2031958"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: control chars in header names may lead to HTTP request smuggling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.\nSince the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.\nThe openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.\nA fix was introduced in netty-codec-http version 4.1.72.Final.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Data Grid 8.3.0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "RHBZ#2031958",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031958"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43797",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq"
        }
      ],
      "release_date": "2021-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-14T13:06:09+00:00",
          "details": "To install this update, do the following:\n \n1. Download the Data Grid 8.3.0 Server patch from the customer portal[\u00b2].\n2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.\n3. Install the Data Grid 8.3.0 Server patch.\n4. Restart Data Grid to ensure the changes take effect.\n\nFor more information about Data Grid 8.3.0, refer to the 8.3.0 Release Notes[\u00b3]",
          "product_ids": [
            "Red Hat Data Grid 8.3.0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0520"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Data Grid 8.3.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: control chars in header names may lead to HTTP request smuggling"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 2.2.5 includes security updates, bug fixes, and enhancements. For more information, see the release notes page listed in the References section.\n\nSecurity Fix(es):\n\n* kafka-clients: Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients (CVE-2021-38153)\n\n* kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)\n\n* jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck (CVE-2021-37714)\n\n* jakarta.el: jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)\n\n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* mysql-connector-java: unauthorized access to critical (CVE-2021-2471)\n\n* cron-utils: template Injection leading to unauthenticated Remote Code Execution(CVE-2021-41269)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:0589",
        "url": "https://access.redhat.com/errata/RHSA-2022:0589"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=2.2.5",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=2.2.5"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/2.2/",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_build_of_quarkus/2.2/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/articles/4966181",
        "url": "https://access.redhat.com/articles/4966181"
      },
      {
        "category": "external",
        "summary": "1965497",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965497"
      },
      {
        "category": "external",
        "summary": "1995259",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995259"
      },
      {
        "category": "external",
        "summary": "2004133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
      },
      {
        "category": "external",
        "summary": "2004135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
      },
      {
        "category": "external",
        "summary": "2009041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2009041"
      },
      {
        "category": "external",
        "summary": "2020583",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020583"
      },
      {
        "category": "external",
        "summary": "2024632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024632"
      },
      {
        "category": "external",
        "summary": "2034388",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0589.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 2.2.5 release and security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:32:15+00:00",
      "generator": {
        "date": "2026-05-14T22:32:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2022:0589",
      "initial_release_date": "2022-02-21T18:22:15+00:00",
      "revision_history": [
        {
          "date": "2022-02-21T18:22:15+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-02-21T18:22:15+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:32:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 2.2.5",
                "product": {
                  "name": "Red Hat build of Quarkus 2.2.5",
                  "product_id": "Red Hat build of Quarkus 2.2.5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_application_runtimes:1.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-2471",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2021-11-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2020583"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External Entity(XXE) vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors\u0027 accessible data without any authorization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mysql-connector-java: unauthorized access to critical",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Presto component is part of the OCP Metering stack and it ships the vulnerable version of the MySQL Connector/J package. Since the release of OCP 4.6, the Metering product has been deprecated and is removed from OCP starting from 4.9 version [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html#ocp-4-9-deprecated-removed-features",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-2471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2020583",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020583"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-2471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-2471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-2471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2471"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2021.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "release_date": "2021-10-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mysql-connector-java: unauthorized access to critical"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jordy Versmissen"
          ]
        }
      ],
      "cve": "CVE-2021-4178",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034388"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kubernetes-client: Insecure deserialization in unmarshalYaml method",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat CodeReady Studio 12 is not affected by this flaw because it does not ship a vulnerable version of kubernetes-client; the version that it ships does not use SnakeYAML.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-4178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034388",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178"
        }
      ],
      "release_date": "2022-01-05T15:05:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kubernetes-client: Insecure deserialization in unmarshalYaml method"
    },
    {
      "cve": "CVE-2021-28170",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-05-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1965497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-28170"
        },
        {
          "category": "external",
          "summary": "RHBZ#1965497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-28170",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-28170"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28170",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28170"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/",
          "url": "https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/"
        }
      ],
      "release_date": "2021-04-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate"
    },
    {
      "cve": "CVE-2021-37136",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data"
    },
    {
      "cve": "CVE-2021-37137",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way"
    },
    {
      "cve": "CVE-2021-37714",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-08-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1995259"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37714"
        },
        {
          "category": "external",
          "summary": "RHBZ#1995259",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995259"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37714",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37714"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37714",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37714"
        },
        {
          "category": "external",
          "summary": "https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c",
          "url": "https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c"
        }
      ],
      "release_date": "2021-08-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck"
    },
    {
      "cve": "CVE-2021-38153",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2021-09-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2009041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-38153"
        },
        {
          "category": "external",
          "summary": "RHBZ#2009041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2009041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-38153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-38153"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38153"
        }
      ],
      "release_date": "2021-09-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Kafka: Timing Attack Vulnerability for Apache Kafka Connect and Clients"
    },
    {
      "cve": "CVE-2021-41269",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2021-11-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2024632"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution (RCE) via Java Expression Language (EL) injection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cron-utils: template Injection leading to unauthenticated Remote Code Execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Only projects using the @Cron annotation to validate untrusted Cron expressions are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 2.2.5"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-41269"
        },
        {
          "category": "external",
          "summary": "RHBZ#2024632",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024632"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-41269",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-41269"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41269",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41269"
        }
      ],
      "release_date": "2021-11-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-02-21T18:22:15+00:00",
          "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link for the update. You must be logged in to download the update.",
          "product_ids": [
            "Red Hat build of Quarkus 2.2.5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:0589"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 2.2.5"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "cron-utils: template Injection leading to unauthenticated Remote Code Execution"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A security update to Red Hat Integration Camel Extensions for Quarkus 2.2 is now available. The purpose of this text-only errata is to inform you about the security issues fixed.\n\nRed Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Integration - Camel Extensions for Quarkus 2.2.1 serves as a replacement for 2.2 and includes the following security Fix(es):\n\nSecurity Fix(es):\n\n* cron-utils: template Injection leading to unauthenticated Remote Code Execution (CVE-2021-41269)\n\n* maven: Block repositories using http by default (CVE-2021-26291)\n\n* bouncycastle: Timing issue within the EC math library (CVE-2020-15522)\n\n* mysql-connector-java: unauthorized access to critical (CVE-2021-2471)\n\n* kubernetes-client: Insecure deserialization in unmarshalYaml method (CVE-2021-4178)\n\n* protobuf-java: potential DoS in the parsing procedure for binary data (CVE-2021-22569)\n\n* jersey: Local information disclosure via system temporary directory (CVE-2021-28168)\n\n* jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170)\n\n* mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server (CVE-2021-30129)\n\n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* xml-security: XPath Transform abuse allows for information disclosure (CVE-2021-40690)\n\n* h2: Remote Code Execution in Console (CVE-2021-42392)\n\n* guava: local information disclosure via temporary directory created with unsafe permissions (CVE-2020-8908)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:1013",
        "url": "https://access.redhat.com/errata/RHSA-2022:1013"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2022-Q2",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions\u0026product=red.hat.integration\u0026version=2022-Q2"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q2",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_integration/2022.q2"
      },
      {
        "category": "external",
        "summary": "1906919",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906919"
      },
      {
        "category": "external",
        "summary": "1953024",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1953024"
      },
      {
        "category": "external",
        "summary": "1955739",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955739"
      },
      {
        "category": "external",
        "summary": "1962879",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1962879"
      },
      {
        "category": "external",
        "summary": "1965497",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965497"
      },
      {
        "category": "external",
        "summary": "1981527",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981527"
      },
      {
        "category": "external",
        "summary": "2004133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
      },
      {
        "category": "external",
        "summary": "2004135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
      },
      {
        "category": "external",
        "summary": "2011190",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011190"
      },
      {
        "category": "external",
        "summary": "2020583",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020583"
      },
      {
        "category": "external",
        "summary": "2024632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024632"
      },
      {
        "category": "external",
        "summary": "2034388",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
      },
      {
        "category": "external",
        "summary": "2039403",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039403"
      },
      {
        "category": "external",
        "summary": "2039903",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039903"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1013.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update",
    "tracking": {
      "current_release_date": "2026-05-14T22:32:29+00:00",
      "generator": {
        "date": "2026-05-14T22:32:29+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.0"
        }
      },
      "id": "RHSA-2022:1013",
      "initial_release_date": "2022-03-22T15:33:40+00:00",
      "revision_history": [
        {
          "date": "2022-03-22T15:33:40+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-03-22T15:33:40+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-14T22:32:29+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHINT Camel-Q 2.2.1",
                "product": {
                  "name": "RHINT Camel-Q 2.2.1",
                  "product_id": "RHINT Camel-Q 2.2.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:camel_quarkus:2.2.1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Integration"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-8908",
      "cwe": {
        "id": "CWE-379",
        "name": "Creation of Temporary File in Directory with Insecure Permissions"
      },
      "discovery_date": "2020-12-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1906919"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Guava that creates temporary directories with default permissions similar to /tmp. This issue may allow local users access, possibly permitting information exposure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "guava: local information disclosure via temporary directory created with unsafe permissions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform\u0027s OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-8908"
        },
        {
          "category": "external",
          "summary": "RHBZ#1906919",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1906919"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8908",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-8908"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8908"
        }
      ],
      "release_date": "2020-09-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "guava: local information disclosure via temporary directory created with unsafe permissions"
    },
    {
      "cve": "CVE-2020-15522",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2021-05-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1962879"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in bouncycastle. A timing issue within the EC math library can expose information about the private key when an attacker is able to observe timing information for the generation of multiple deterministic ECDSA signatures.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "bouncycastle: Timing issue within the EC math library",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-15522"
        },
        {
          "category": "external",
          "summary": "RHBZ#1962879",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1962879"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15522",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-15522"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15522",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15522"
        }
      ],
      "release_date": "2021-05-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "bouncycastle: Timing issue within the EC math library"
    },
    {
      "cve": "CVE-2021-2471",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2021-11-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2020583"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "MySQL Connector/J has no security check when external general entities are included in XML sources, consequently, there exists an XML External Entity(XXE) vulnerability. A successful attack can access critical data and gain full control/access to all MySQL Connectors\u0027 accessible data without any authorization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mysql-connector-java: unauthorized access to critical",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Presto component is part of the OCP Metering stack and it ships the vulnerable version of the MySQL Connector/J package. Since the release of OCP 4.6, the Metering product has been deprecated and is removed from OCP starting from 4.9 version [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html#ocp-4-9-deprecated-removed-features",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-2471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2020583",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2020583"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-2471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-2471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-2471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-2471"
        },
        {
          "category": "external",
          "summary": "https://www.oracle.com/security-alerts/cpuoct2021.html",
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        }
      ],
      "release_date": "2021-10-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mysql-connector-java: unauthorized access to critical"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Jordy Versmissen"
          ]
        }
      ],
      "cve": "CVE-2021-4178",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2021-12-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2034388"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kubernetes-client: Insecure deserialization in unmarshalYaml method",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat CodeReady Studio 12 is not affected by this flaw because it does not ship a vulnerable version of kubernetes-client; the version that it ships does not use SnakeYAML.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-4178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2034388",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2034388"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-4178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-4178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4178"
        }
      ],
      "release_date": "2022-01-05T15:05:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kubernetes-client: Insecure deserialization in unmarshalYaml method"
    },
    {
      "cve": "CVE-2021-22569",
      "cwe": {
        "id": "CWE-696",
        "name": "Incorrect Behavior Order"
      },
      "discovery_date": "2022-01-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2039903"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobuf-java. Google Protocol Buffer (protobuf-java) allows the interleaving of com.google.protobuf.UnknownFieldSet fields. By persuading a victim to open specially-crafted content, a remote attacker could cause a timeout in the ProtobufFuzzer function, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobuf-java: potential DoS in the parsing procedure for binary data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-22569"
        },
        {
          "category": "external",
          "summary": "RHBZ#2039903",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039903"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-22569",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-22569"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-22569",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22569"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/commit/b3093dce58bc9d3042f085666d83c8ef1f51fe7b",
          "url": "https://github.com/protocolbuffers/protobuf/commit/b3093dce58bc9d3042f085666d83c8ef1f51fe7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67",
          "url": "https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-wrvw-hg22-4m67"
        }
      ],
      "release_date": "2022-01-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "protobuf-java: potential DoS in the parsing procedure for binary data"
    },
    {
      "cve": "CVE-2021-26291",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2021-04-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1955739"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in maven. Repositories that are defined in a dependency\u2019s Project Object Model (pom), which may be unknown to users, are used by default resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. The highest threat from this vulnerability is to data confidentiality and integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "maven: Block repositories using http by default",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-26291"
        },
        {
          "category": "external",
          "summary": "RHBZ#1955739",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955739"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-26291",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-26291"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-26291",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26291"
        },
        {
          "category": "external",
          "summary": "https://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291",
          "url": "https://maven.apache.org/docs/3.8.1/release-notes.html#cve-2021-26291"
        }
      ],
      "release_date": "2021-04-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        },
        {
          "category": "workaround",
          "details": "To avoid possible man-in-the-middle related attacks with this flaw, ensure any linked repositories in maven POMs use https and not http.",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "maven: Block repositories using http by default"
    },
    {
      "cve": "CVE-2021-28168",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2021-04-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1953024"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are viewable by all other users locally on the system. As such, if the contents written is security sensitive, it can be disclosed to other local users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jersey: Local information disclosure via system temporary directory",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform\u0027s OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Important and Critical flaws.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-28168"
        },
        {
          "category": "external",
          "summary": "RHBZ#1953024",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1953024"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-28168",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-28168"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28168",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28168"
        }
      ],
      "release_date": "2021-04-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jersey: Local information disclosure via system temporary directory"
    },
    {
      "cve": "CVE-2021-28170",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2021-05-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1965497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-28170"
        },
        {
          "category": "external",
          "summary": "RHBZ#1965497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1965497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-28170",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-28170"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-28170",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28170"
        },
        {
          "category": "external",
          "summary": "https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/",
          "url": "https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/"
        }
      ],
      "release_date": "2021-04-01T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate"
    },
    {
      "cve": "CVE-2021-30129",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-07-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1981527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in sshd-core of Apache Mina SSHD allows an attacker to overflow the server causing an OutOfMemory error. This issue affects the SFTP and port forwarding features of Apache Mina SSHD version 2.0.0 and later versions. It was addressed in Apache Mina SSHD 2.7.0",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack Platform\u0027s OpenDaylight will not be updated for this flaw because it was deprecated as of OpenStack Platform 14 and is only receiving security fixes for Critical flaws.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-30129"
        },
        {
          "category": "external",
          "summary": "RHBZ#1981527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1981527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-30129",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-30129"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-30129",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30129"
        }
      ],
      "release_date": "2021-07-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mina-sshd-core: Memory leak denial of service in Apache Mina SSHD Server"
    },
    {
      "cve": "CVE-2021-37136",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data"
    },
    {
      "cve": "CVE-2021-37137",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way"
    },
    {
      "cve": "CVE-2021-40690",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2021-09-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2011190"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the \"secureValidation\" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xml-security: XPath Transform abuse allows for information disclosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Since OpenShift Container Platform (OCP) 4.7, the logging-elasticsearch6-container is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-40690"
        },
        {
          "category": "external",
          "summary": "RHBZ#2011190",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2011190"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-40690",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-40690"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-40690",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40690"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E",
          "url": "https://lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E"
        }
      ],
      "release_date": "2021-09-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "xml-security: XPath Transform abuse allows for information disclosure"
    },
    {
      "cve": "CVE-2021-41269",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2021-11-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2024632"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cron-utils. This flaw allows an attacker to perform unauthenticated Remote Code Execution (RCE) via Java Expression Language (EL) injection.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cron-utils: template Injection leading to unauthenticated Remote Code Execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Only projects using the @Cron annotation to validate untrusted Cron expressions are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-41269"
        },
        {
          "category": "external",
          "summary": "RHBZ#2024632",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024632"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-41269",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-41269"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-41269",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41269"
        }
      ],
      "release_date": "2021-11-17T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "cron-utils: template Injection leading to unauthenticated Remote Code Execution"
    },
    {
      "cve": "CVE-2021-42392",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2022-01-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2039403"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in h2. The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. This flaw allows an attacker to use this URL to send another server\u2019s code, causing remote code execution. This issue is exploited through various attack vectors, most notably through the H2 Console, which leads to unauthenticated remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "h2: Remote Code Execution in Console",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP) the openshift4/ose-metering-presto container image ships the vulnerable version of h2, but as it uses default configuration the impact by this vulnerability is LOW. Additionally, the Presto component is part of the OCP Metering stack and since the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected component is marked as wontfix.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "RHINT Camel-Q 2.2.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-42392"
        },
        {
          "category": "external",
          "summary": "RHBZ#2039403",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2039403"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-42392",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-42392"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-42392",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42392"
        },
        {
          "category": "external",
          "summary": "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6",
          "url": "https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6"
        }
      ],
      "release_date": "2022-01-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-03-22T15:33:40+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "RHINT Camel-Q 2.2.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:1013"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "RHINT Camel-Q 2.2.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "h2: Remote Code Execution in Console"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Logging Subsystem 5.4.1 - Red Hat OpenShift\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Logging Subsystem 5.4.1 - Red Hat OpenShift\n\nSecurity Fix(es):\n\n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:2216",
        "url": "https://access.redhat.com/errata/RHSA-2022:2216"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2004133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
      },
      {
        "category": "external",
        "summary": "2004135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
      },
      {
        "category": "external",
        "summary": "2031958",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031958"
      },
      {
        "category": "external",
        "summary": "2045880",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2045880"
      },
      {
        "category": "external",
        "summary": "LOG-2437",
        "url": "https://issues.redhat.com/browse/LOG-2437"
      },
      {
        "category": "external",
        "summary": "LOG-2442",
        "url": "https://issues.redhat.com/browse/LOG-2442"
      },
      {
        "category": "external",
        "summary": "LOG-2448",
        "url": "https://issues.redhat.com/browse/LOG-2448"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2216.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Logging Security and Bug update Release 5.4.1",
    "tracking": {
      "current_release_date": "2026-05-27T20:31:57+00:00",
      "generator": {
        "date": "2026-05-27T20:31:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:2216",
      "initial_release_date": "2022-05-11T18:50:05+00:00",
      "revision_history": [
        {
          "date": "2022-05-11T18:50:05+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-05-11T18:50:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-27T20:31:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHOL 5.4 for RHEL 8",
                "product": {
                  "name": "RHOL 5.4 for RHEL 8",
                  "product_id": "8Base-RHOL-5.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.4::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "logging for Red Hat OpenShift"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.4.1-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-169"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-125"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-123"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-156"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-162"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.5-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-187"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
                "product": {
                  "name": "openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
                  "product_id": "openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.5.0-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
                "product": {
                  "name": "openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
                  "product_id": "openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.14-40"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
                "product": {
                  "name": "openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
                  "product_id": "openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
                "product": {
                  "name": "openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
                  "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
                "product": {
                  "name": "openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
                  "product_id": "openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v5.4.1-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.4.1-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
                  "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.4.1-24"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
                  "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.4.1-24"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-169"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-125"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-123"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-156"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-162"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.5-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-187"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
                "product": {
                  "name": "openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
                  "product_id": "openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.5.0-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
                "product": {
                  "name": "openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
                  "product_id": "openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.14-40"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
                "product": {
                  "name": "openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
                  "product_id": "openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=v5.4.1-23"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
                "product": {
                  "name": "openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
                  "product_id": "openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
                "product": {
                  "name": "openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
                  "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
                "product": {
                  "name": "openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
                  "product_id": "openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v5.4.1-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.4.1-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-169"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-125"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-123"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-156"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-162"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.5-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-187"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
                "product": {
                  "name": "openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
                  "product_id": "openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.5.0-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
                "product": {
                  "name": "openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
                  "product_id": "openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.14-40"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
                "product": {
                  "name": "openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
                  "product_id": "openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
                "product": {
                  "name": "openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
                  "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
                "product": {
                  "name": "openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
                  "product_id": "openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v5.4.1-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.4.1-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-169"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-125"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-123"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-156"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-162"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.14.5-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-187"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
                "product": {
                  "name": "openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
                  "product_id": "openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel8\u0026tag=v2.5.0-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64",
                "product": {
                  "name": "openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64",
                  "product_id": "openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel8\u0026tag=v0.14-40"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
                "product": {
                  "name": "openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
                  "product_id": "openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel8-operator\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
                "product": {
                  "name": "openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
                  "product_id": "openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel8\u0026tag=v5.4.1-4"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
                "product": {
                  "name": "openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
                  "product_id": "openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel8\u0026tag=v5.4.1-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64"
        },
        "product_reference": "openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64"
        },
        "product_reference": "openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le"
        },
        "product_reference": "openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x"
        },
        "product_reference": "openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64"
        },
        "product_reference": "openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le"
        },
        "product_reference": "openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x"
        },
        "product_reference": "openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64"
        },
        "product_reference": "openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64"
        },
        "product_reference": "openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x"
        },
        "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64"
        },
        "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le"
        },
        "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64"
        },
        "product_reference": "openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x"
        },
        "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64"
        },
        "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64"
        },
        "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le"
        },
        "product_reference": "openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x"
        },
        "product_reference": "openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le"
        },
        "product_reference": "openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64"
        },
        "product_reference": "openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64 as a component of RHOL 5.4 for RHEL 8",
          "product_id": "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
        },
        "product_reference": "openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64",
        "relates_to_product_reference": "8Base-RHOL-5.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-37136",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
        ],
        "known_not_affected": [
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T18:50:05+00:00",
          "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nFor Red Hat OpenShift Logging 5.4, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2216"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data"
    },
    {
      "cve": "CVE-2021-37137",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
        ],
        "known_not_affected": [
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T18:50:05+00:00",
          "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nFor Red Hat OpenShift Logging 5.4, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2216"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way"
    },
    {
      "cve": "CVE-2021-43797",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2021-12-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2031958"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: control chars in header names may lead to HTTP request smuggling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.\nSince the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.\nThe openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.\nA fix was introduced in netty-codec-http version 4.1.72.Final.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
        ],
        "known_not_affected": [
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "RHBZ#2031958",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031958"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43797",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq"
        }
      ],
      "release_date": "2021-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T18:50:05+00:00",
          "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nFor Red Hat OpenShift Logging 5.4, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2216"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: control chars in header names may lead to HTTP request smuggling"
    },
    {
      "cve": "CVE-2022-21698",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2022-01-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2045880"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service attack was found in prometheus/client_golang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "prometheus/client_golang: Denial of service using InstrumentHandlerCounter",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has been rated as having a moderate impact for two main reasons. The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. Additionally, this is in alignment with upstream\u0027s (the Prometheus project) impact rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x"
        ],
        "known_not_affected": [
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
          "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
          "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
          "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
          "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
          "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
          "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
          "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
          "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
          "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "RHBZ#2045880",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2045880"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21698",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21698",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p",
          "url": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p"
        }
      ],
      "release_date": "2022-02-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T18:50:05+00:00",
          "details": "For OpenShift Container Platform 4.9 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.9/release_notes/ocp-4-9-release-notes.html\n\nFor Red Hat OpenShift Logging 5.4, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2216"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-operator-bundle@sha256:ca895c22495faa6c8ca16a45b81538fc7601575c9339997a81ebc342d08a807f_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:04ebd764d8b535f11a6e9e6523a719d9a12000383bcf2c3e582ee9522901ed73_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:48e2848133b60700361402d5a8e704bf9fb191ddcd4c1e833942121ece82c663_s390x",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:9d7487f74543173dbc45bf886c62c0cba9360971c6adf8e348910430bcb22636_amd64",
            "8Base-RHOL-5.4:openshift-logging/cluster-logging-rhel8-operator@sha256:f37d9f99aeea2f757b870c952b803b4c947c1d02f4017f297b01317d37366068_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-operator-bundle@sha256:49dd833c9b58247cb2abb78d841551342edb29c430ba0e0b88229870e3dec340_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:31642653e7ece566609f8546e2ae48c55380f035d965e67194f70b2f0cd9c9a7_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:5d5a50d38a2eb5fd8844dc70ec7be62a89d4ad00e71a66edf987fbb2fe0be1c6_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:719fc87169056c3ffb0c2a314f312e865e1d6c76b2d0e84e01146614d2ac91b4_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-proxy-rhel8@sha256:7ab8aee7cddcea20f7124bdbb90eb8100c1deb5c3bc45a07b8f18fec4242c92c_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:16b864acf4276f813cb4daa0597d2a7e978267bca4a67deed677cc3de69f282a_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:3d750d485a389a9e67b54c0eaba535af31f48949616b8474dea4a018ac895ae6_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:4bc6cb30701e2dee935b3e5ce24dc1e895d5c006728dd40c7b5e2f45d0949260_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch-rhel8-operator@sha256:dab6ede97d78f77e030483462fa29053f3d696e88671b9c8260d0567638d667d_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:13283f9c8b5f724fceb4f56d98590fd41011cb2ac61d1326cd34ae756da13716_s390x",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:27b837c12fcdb7384855cf8db0232c627b7f67f345bf4cd1c7b4d9fa9d7bc123_arm64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:555c29307512e13976f75baa4359598fc84db3429e7787c2b0fd180251945853_amd64",
            "8Base-RHOL-5.4:openshift-logging/elasticsearch6-rhel8@sha256:d444081e000340d81d036dd2baf5644624499e21cc69be9eb798907818c3cd17_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:05a0fd03a2135557cb45c73b1c2c46efbf36f1b52a4becdfd7414b45f1002a8b_s390x",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:1298709126c58075a5f27db35a34ef5c1652bfbe130b590c3b10d5b64fdd9060_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:81d588bb6ccc5b2b044df5a83db13a6dcb51f0f4f897cc6350f1df6ee88b450c_arm64",
            "8Base-RHOL-5.4:openshift-logging/eventrouter-rhel8@sha256:f276cdb3d81add9efdd69cf62987086d2222a321d741b55cb52edfd8a757f0af_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:23d1c5ab1568f8fbbc1139328f5f95c6b185619778188f3e81b97eaaade8918b_amd64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:95ef878730d5ec17875329ae81ff02a44c56b984cfd8e185d16911df3169d1f5_arm64",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:bb6b987d04a9ed0c87deaec75568b1aa34e2d6e22e5745da2153cd11fcf91725_s390x",
            "8Base-RHOL-5.4:openshift-logging/fluentd-rhel8@sha256:cb4c7926d4f1db746adcf8e86bfa45c5c0264c999787e92223b7ef86eeed80dd_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:00d4fe63607d468ed428e66829ccee9bc52f2d60a6fa01336a2e229685d932d3_s390x",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:473153335fffbee921da5fd824d98a198c61aa639052445c77af431a12fa3603_arm64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:6c9810627c3ec147be951ade002941dab1135a2d34a86f50899659e6d2fc73c0_amd64",
            "8Base-RHOL-5.4:openshift-logging/kibana6-rhel8@sha256:8b8c8f36efa594d07908c79218144f988d86acbb372b61a293271ba3833ba220_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:26f8366309caf86d0262e260b610ab8fe086626b57df3bda02d29de781945993_s390x",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:99b7cf5c324fc8af651db31f5b8fc3a7c1703ea2d91e372f7c0f643a70b8a647_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:c72443902663a55aabab92e5915593914bb56300842e6309699a683856b88e1a_amd64",
            "8Base-RHOL-5.4:openshift-logging/log-file-metric-exporter-rhel8@sha256:ef2ccc24f528231c683c5cbd812f066a40c0d7e96f9c587f94b0e932fe57867b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:7641e78c533af864223c2118fd470f2ae5124ebf05c763eda61059a4459b72b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca02f9b58428cb51129721cdad182918e3fad94c27e9a82e47199214ef6c032d_s390x",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:ca5220211de5b4ff9fd68933dd52bf98576b1941e32cde481b3fbd09be38889d_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-curator5-rhel8@sha256:f2454f858bbf94d8f33e4bd482f06cca8bf8bc0d65e56dca6754b2048e372a2f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:712763e5a37bff1359ac524a9a0b27512204666832bef5b45cddad6d05729a4b_arm64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:7e0815dcbca4cb4b75fe13d21c383d2d9510c61417268af9a1077560dc26b21f_amd64",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:ddc7fde39c50b6804bd20c937ff1f8ed64b23c1285fbb03a02c43c0c424bce0f_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/logging-loki-rhel8@sha256:e77370c1fbc0484d288f9dadacd2d15b098c0a82c9fdd0d839525b8963311927_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-operator-bundle@sha256:bab9081e04c303a2042c01dd75c7e0fcca07fc8d2519a15d083894d34d3dfed4_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:0467dda173e8aa009433e7a8682f4ecef586e4709c42775bf57147990e6c6cd0_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:07c605f1b3936742179fbcd97a6a27cd5cfc9eb6c67410ce47ebc9487d6ba808_s390x",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:7fe279546cdff7661c30866a4d7e3cab45535c119383890bd5603d37876d74c7_amd64",
            "8Base-RHOL-5.4:openshift-logging/loki-rhel8-operator@sha256:a88fdf30ad3372013f532d5fb405aa408aafa228010585a6bc29040aeaf8287f_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:3781e0fb7614ff4dd6b2fa7bc9466543ab67b31e17700674fb720f6914da91bd_s390x",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:4575e2f98bab47dd02b244baaca20050843aa8f11c8aba913b70ba8446a2a4b7_arm64",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:79641024f7bea50d2c633e8b9cd76eef829de88be8fd8686b8d695617e406af5_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/lokistack-gateway-rhel8@sha256:d81ec870e559c83ab5a043e145cf2d07b10ed959ec5dc23cfc58dd47771ce543_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:3e53791bfb28e318c05f8360fe1c1253c12d201a9c6d590432a168a224a3eb5a_s390x",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:69e854e2aee34946d9614fa031f7f7dda2708bed53fd7405a46e7aad24ef7545_amd64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:af31ac0c3282b25ece0b78de4241fb57458d026c4b7728d93d0254ef167c18c3_arm64",
            "8Base-RHOL-5.4:openshift-logging/opa-openshift-rhel8@sha256:bd02091cfcf33e43194f82116f7f9e5ed17719521805a985862ff8548bc1c4b6_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:33cc1c4cbda1435a7a4c1fff01b237259296869c59f2529ac4896de78b650a4f_s390x",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:35b3f1c7671a4d9265a0b397b82838870735b186fc4d543d7c568de6901ad1e8_ppc64le",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:9c08c8e7500d2de0a2de59551561eab558a712cb6928e016a1a4fafffb245dcf_amd64",
            "8Base-RHOL-5.4:openshift-logging/vector-rhel8@sha256:edf4bb4cbb74a50cb0b30f0766d1753503405a65d660f918ca5b1863e00ea3e0_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "prometheus/client_golang: Denial of service using InstrumentHandlerCounter"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Openshift Logging Bug Fix Release (5.3.7)\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Openshift Logging Bug Fix Release (5.3.7)\n\nSecurity Fix(es):\n\n* kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)\n\n* netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data (CVE-2021-37136)\n\n* netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way (CVE-2021-37137)\n\n* netty: control chars in header names may lead to HTTP request smuggling (CVE-2021-43797)\n\n* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2022:2217",
        "url": "https://access.redhat.com/errata/RHSA-2022:2217"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "2004133",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
      },
      {
        "category": "external",
        "summary": "2004135",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
      },
      {
        "category": "external",
        "summary": "2031958",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031958"
      },
      {
        "category": "external",
        "summary": "2045880",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2045880"
      },
      {
        "category": "external",
        "summary": "2058404",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2058404"
      },
      {
        "category": "external",
        "summary": "LOG-2334",
        "url": "https://issues.redhat.com/browse/LOG-2334"
      },
      {
        "category": "external",
        "summary": "LOG-2450",
        "url": "https://issues.redhat.com/browse/LOG-2450"
      },
      {
        "category": "external",
        "summary": "LOG-2481",
        "url": "https://issues.redhat.com/browse/LOG-2481"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2217.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Logging Security and Bug update Release 5.3.7",
    "tracking": {
      "current_release_date": "2026-05-27T20:31:57+00:00",
      "generator": {
        "date": "2026-05-27T20:31:57+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.8.1"
        }
      },
      "id": "RHSA-2022:2217",
      "initial_release_date": "2022-05-11T20:33:12+00:00",
      "revision_history": [
        {
          "date": "2022-05-11T20:33:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2022-05-11T20:33:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-27T20:31:57+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "OpenShift Logging 5.3",
                "product": {
                  "name": "OpenShift Logging 5.3",
                  "product_id": "8Base-OSE-LOGGING-5.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:logging:5.3::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.3.7-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.3.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-171"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-127"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-126"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-159"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-164"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-178"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-190"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.3.7-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
                "product": {
                  "name": "openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
                  "product_id": "openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=v5.3.7-20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.3.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
                  "product_id": "openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-operator-bundle\u0026tag=v5.3.7-20"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-171"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-127"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-126"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-159"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-164"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-178"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-190"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
                "product": {
                  "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
                  "product_id": "openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel8-operator\u0026tag=v5.3.7-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-rhel8-operator\u0026tag=v5.3.7-5"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
                  "product_id": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch-proxy-rhel8\u0026tag=v1.0.0-171"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
                "product": {
                  "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
                  "product_id": "openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel8\u0026tag=v1.0.0-127"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le",
                "product": {
                  "name": "openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le",
                  "product_id": "openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-curator5-rhel8\u0026tag=v5.8.1-126"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
                "product": {
                  "name": "openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
                  "product_id": "openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8\u0026tag=v6.8.1-159"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
                "product": {
                  "name": "openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
                  "product_id": "openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel8\u0026tag=v0.3.0-164"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
                "product": {
                  "name": "openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
                  "product_id": "openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/fluentd-rhel8\u0026tag=v1.7.4-178"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
                "product": {
                  "name": "openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
                  "product_id": "openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/kibana6-rhel8\u0026tag=v6.8.1-190"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64"
        },
        "product_reference": "openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
        },
        "product_reference": "openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x"
        },
        "product_reference": "openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64"
        },
        "product_reference": "openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le"
        },
        "product_reference": "openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le"
        },
        "product_reference": "openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64 as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le as a component of OpenShift Logging 5.3",
          "product_id": "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
        },
        "product_reference": "openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le",
        "relates_to_product_reference": "8Base-OSE-LOGGING-5.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-37136",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004133"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec due to size restrictions for decompressed data in the Bzip2Decoder. By sending a specially-crafted input, a remote attacker could cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In the OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack ship the vulnerable version of netty-codec package. Since the release of OCP 4.6, the Metering product has been deprecated [1], so the affected components are marked as wontfix. This may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004133",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004133"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37136"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T20:33:12+00:00",
          "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2217"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: Bzip2Decoder doesn\u0027t allow setting size restrictions for decompressed data"
    },
    {
      "cve": "CVE-2021-37137",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2021-09-14T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2004135"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty\u0027s netty-codec due to unrestricted chunk lengths in the SnappyFrameDecoder. By sending a specially-crafted input, a remote attacker could cause excessive memory usage resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec package.\nSince the release of OCP 4.6, the Metering product has been deprecated [1], hence the affected components are marked as wontfix.\nThis may be fixed in the future.\n\nStarting in OCP 4.7, the elasticsearch component is shipping as a part of the OpenShift Logging product (openshift-logging/elasticsearch6-rhel8). The elasticsearch component delivered in OCP 4.6 is marked as `Out of support scope` because these versions are already under Maintenance Phase of the support.\n\n[1] https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html#ocp-4-6-metering-operator-deprecated",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2004135",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2004135"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-37137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37137"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-grg4-wf29-r9vv"
        }
      ],
      "release_date": "2021-09-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T20:33:12+00:00",
          "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2217"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec: SnappyFrameDecoder doesn\u0027t restrict chunk length and may buffer skippable chunks in an unnecessary way"
    },
    {
      "cve": "CVE-2021-43797",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2021-12-09T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2031958"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, specifically in the netty-codec-http package. This flaw allows unauthorized control characters at the beginning and end of a request, does not follow the specification, and can cause HTTP request smuggling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: control chars in header names may lead to HTTP request smuggling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In OpenShift Container Platform (OCP), the Hive/Presto/Hadoop components that comprise the OCP Metering stack, ship the vulnerable version of netty-codec-http package.\nSince the release of OCP 4.6, the Metering product has been deprecated, hence the affected components are marked as wontfix.\nThe openshift4/ose-logging-elasticsearch6 container is marked as Out of support scope because since the release of OCP 4.7 the logging functionality is delivered as an OpenShift Logging product and OCP 4.6 is already in the Maintenance Support phase.\nA fix was introduced in netty-codec-http version 4.1.72.Final.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "RHBZ#2031958",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031958"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-43797",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43797"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-wx5j-54mm-rqqq"
        }
      ],
      "release_date": "2021-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T20:33:12+00:00",
          "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2217"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty: control chars in header names may lead to HTTP request smuggling"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Beni Paskin Cherniavsky"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2022-0759",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2022-02-15T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2058404"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kubeclient, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kubeclient: kubeconfig parsing error can lead to MITM attacks",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-0759"
        },
        {
          "category": "external",
          "summary": "RHBZ#2058404",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2058404"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-0759",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-0759"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-0759",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0759"
        }
      ],
      "release_date": "2022-03-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T20:33:12+00:00",
          "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2217"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kubeclient: kubeconfig parsing error can lead to MITM attacks"
    },
    {
      "cve": "CVE-2022-21698",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2022-01-19T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2045880"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service attack was found in prometheus/client_golang. This flaw allows an attacker to produce a denial of service attack on an HTTP server by exploiting the InstrumentHandlerCounter function in the version below 1.11.1, resulting in a loss of availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "prometheus/client_golang: Denial of service using InstrumentHandlerCounter",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has been rated as having a moderate impact for two main reasons. The opportunity for a Denial of Service is limited to the golang runtime. In the case of OpenShift Container Platform, this would be restricted within each individual container. Additionally, this is in alignment with upstream\u0027s (the Prometheus project) impact rating.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x"
        ],
        "known_not_affected": [
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
          "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "RHBZ#2045880",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2045880"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2022-21698",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-21698",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21698"
        },
        {
          "category": "external",
          "summary": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p",
          "url": "https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p"
        }
      ],
      "release_date": "2022-02-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2022-05-11T20:33:12+00:00",
          "details": "For OpenShift Container Platform 4.10 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.openshift.com/container-platform/4.10/release_notes/ocp-4-10-release-notes.html\n\nFor Red Hat OpenShift Logging 5.3, see the following instructions to apply this update:\n\nhttps://docs.openshift.com/container-platform/4.7/logging/cluster-logging-upgrading.html",
          "product_ids": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2022:2217"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-operator-bundle@sha256:fa801c97daf5f30c6c68bc299c78482f5a2994f7b93d54d9b775fe0f1cc5adfe_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:0089e0896030fab54ec0240b388ae3e67a6abe2b3c27b44ff2044665526d916e_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:02d893b2e07191ebe687880700fcfc95dd3c951f9d19326435410115915025e0_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/cluster-logging-rhel8-operator@sha256:5c5ec8921be5842e402c3ec5521d88c8917cfd309bd1427d0ba8b3bdb9d72509_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-operator-bundle@sha256:7b95c77ec85fb93ca74a5954462a1050b129648ae4db06bc5a2868008f8746df_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:1ee893d481fec9e96a6d6f6b16a963825d23d212e36948b24aa106e59401ff4a_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:6c5944a63df37790dd59a0c565cb9fe4d645884bcf74596ef3e2be14bd827ecc_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-proxy-rhel8@sha256:b777304418cc8f2700799f61e5e3e60688919fa0978964a336176ea3c0e78701_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:38bc2e9b4fd4d2ce0cdf3762bc4b77f43b0fbd149d93688496db5cfdffac8491_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:528c2f2c78fd58cf9a2d554cc192e55463a6a17aeaaa4d3b44f4cc24deed24a6_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch-rhel8-operator@sha256:c619472fcc907723ff5f3755a627c149db42ecede127b48a46b2ca094d294203_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:3c19ff6940372c621c40a770050f7625fbfbefbe342b51d6b756b0860b2cea8c_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:9d9cba43e0d2b61b6ab6d6d0fd50bfe61c1ff4712c3c6c45760d5144a4f34c61_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/elasticsearch6-rhel8@sha256:a484145be969edf1e6558063603542825e010243606134468464bae2c833c977_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:44e9ee4182aa23780da09d18165d0beb24b36bc7d87ecee61857c271dbb26a1b_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:83363ad421eadf39294a922bdd6b670c4788458877476e5a9a64740ab50b1201_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/eventrouter-rhel8@sha256:e99b920ed1f2443739c1a1889e44ac26d735731b3ff3bab81daf64bd6c4c3179_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:78f92e6374d4e129ec45fba87d287032f737af078d03ef81533860af08c02c77_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:eaaa3996613181f425ecf9fe212d2d1a3d5e7fd52382e5ba43194bac563953f1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/fluentd-rhel8@sha256:f53bcaacf26f778d1512628d8420629d47312f593326c0bc47d6558557dfd6ae_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:39d97c6396d3191d0cd69201f4d6f8d0c8eb76954c37cba9b0675607509f765f_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:756e05395e54f5845191c36e0c3a83fb792b94e96b9f348e491572e0b7089f14_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/kibana6-rhel8@sha256:b2a63d2d038aaf3091cbe4c91ab3a7050a60d5d3876e78d026bd22642cbfa2d7_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:20d4430185b838ed028e2129512998587e12e1b191bb542b6720814aac9e90ea_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:7b422a3f0ef73e52a9197381f50087ea83e853aa2982ed551ec80535ef3b9611_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/log-file-metric-exporter-rhel8@sha256:afc750662cc7cb7bc79f52d4ff1aaaa0da29b4392304982b437fa9cca75798d1_ppc64le",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:1b773e5b4776f3e033274b340382ac59962d0db53e11a97a00610b33fb6ee45b_amd64",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:8b5d32d0221377937d8ab31377eb4f8263559ec9b32985bbf2c38c11a3294bad_s390x",
            "8Base-OSE-LOGGING-5.3:openshift-logging/logging-curator5-rhel8@sha256:950f99b1193e7b96ae1340be391fba4e3525ce172070ae2f7a944903b630c7d2_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "prometheus/client_golang: Denial of service using InstrumentHandlerCounter"
    }
  ]
}