Vulnerability-Lookup

RHBA-2024:3779

Vulnerability from csaf_redhat - Published: 2024-06-10 16:05 - Updated: 2026-11-08 05:01

Summary

Red Hat Bug Fix Advisory: LVMS 4.15.4 Bug Fix Update

Severity

Moderate

Notes

Topic: Updated container images that fix multiple bugs are now available for LVMS 4.15

Details: Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to dynamically provision thin and thick local storage on a cluster with limited resources. Users of LVMS are advised to upgrade to the latest version of LVMS in OpenShift Container Platform, which fixes bugs and security vulnerabilities.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2023-45290

A flaw was discovered in Go's net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-20 - Improper Input Validation

Affected products

Fixed 16 products

Product	Version	Remediation
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x	—	Vendor Fix fix Workaround
Unresolved product id: 9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2024-24783

A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-295 - Improper Certificate Validation

Affected products

Fixed 16 products, the same list as for CVE-2023-45290

Threats

Impact Moderate

References

23 references

URL	Category
https://access.redhat.com/errata/RHBA-2024:3779	self
https://issues.redhat.com/browse/OCPBUGS-32711	external
https://issues.redhat.com/browse/OCPBUGS-33084	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2023-45290	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268017	external
https://www.cve.org/CVERecord?id=CVE-2023-45290	external
https://nvd.nist.gov/vuln/detail/CVE-2023-45290	external
http://www.openwall.com/lists/oss-security/2024/03/08/4	external
https://go.dev/cl/569341	external
https://go.dev/issue/65383	external
https://groups.google.com/g/golang-announce/c/5pw…	external
https://pkg.go.dev/vuln/GO-2024-2599	external
https://security.netapp.com/advisory/ntap-20240329-0004	external
https://access.redhat.com/security/cve/CVE-2024-24783	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268019	external
https://www.cve.org/CVERecord?id=CVE-2024-24783	external
https://nvd.nist.gov/vuln/detail/CVE-2024-24783	external
https://github.com/advisories/GHSA-3q2c-pvp5-3cqp	external
https://go.dev/cl/569339	external
https://go.dev/issue/65390	external
https://pkg.go.dev/vuln/GO-2024-2598	external
https://security.netapp.com/advisory/ntap-20240329-0005	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images that fix multiple bugs are now available for LVMS\n4.15",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Logical Volume Manager Storage uses lvm2 through the TopoLVM CSI driver to\ndynamically provision thin and thick local storage on a cluster with\nlimited resources.\n\nUsers of LVMS are advised to upgrade to the latest version of LVMS in\nOpenShift Container Platform, which fixes bugs and security\nvulnerabilities.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHBA-2024:3779",
        "url": "https://access.redhat.com/errata/RHBA-2024:3779"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-32711",
        "url": "https://issues.redhat.com/browse/OCPBUGS-32711"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-33084",
        "url": "https://issues.redhat.com/browse/OCPBUGS-33084"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_3779.json"
      }
    ],
    "title": "Red Hat Bug Fix Advisory: LVMS 4.15.4 Bug Fix Update",
    "tracking": {
      "current_release_date": "2026-11-08T05:01:00+00:00",
      "generator": {
        "date": "2026-11-08T05:01:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHBA-2024:3779",
      "initial_release_date": "2024-06-10T16:05:16+00:00",
      "revision_history": [
        {
          "date": "2024-06-10T16:05:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2024-06-10T16:05:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-08T05:01:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "LVMS 4.15 for RHEL 9",
                "product": {
                  "name": "LVMS 4.15 for RHEL 9",
                  "product_id": "9Base-LVMS-4.15",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:lvms:4.15::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "logical volume manager storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
                  "product_id": "lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.15.4-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
                  "product_id": "lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.15.4-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
                  "product_id": "lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.15.4-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
                "product": {
                  "name": "lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
                  "product_id": "lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
                "product": {
                  "name": "lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
                  "product_id": "lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
                "product": {
                  "name": "lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
                  "product_id": "lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.15.4-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64",
                "product": {
                  "name": "lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64",
                  "product_id": "lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.15.4-5"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x"
        },
        "product_reference": "lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64"
        },
        "product_reference": "lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64"
        },
        "product_reference": "lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64 as a component of LVMS 4.15 for RHEL 9",
          "product_id": "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
        },
        "product_reference": "lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64",
        "relates_to_product_reference": "9Base-LVMS-4.15"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-45290",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2024-03-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268017"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in Go\u0027s net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-45290"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268017",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268017"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-45290",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-45290"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/569341",
          "url": "https://go.dev/cl/569341"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/65383",
          "url": "https://go.dev/issue/65383"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2599",
          "url": "https://pkg.go.dev/vuln/GO-2024-2599"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20240329-0004",
          "url": "https://security.netapp.com/advisory/ntap-20240329-0004"
        }
      ],
      "release_date": "2024-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-06-10T16:05:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:3779"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm"
    },
    {
      "cve": "CVE-2024-24783",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2024-03-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268019"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
          "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
          "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
          "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
          "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268019",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp",
          "url": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/569339",
          "url": "https://go.dev/cl/569339"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/65390",
          "url": "https://go.dev/issue/65390"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2598",
          "url": "https://pkg.go.dev/vuln/GO-2024-2598"
        },
        {
          "category": "external",
          "summary": "https://security.netapp.com/advisory/ntap-20240329-0005",
          "url": "https://security.netapp.com/advisory/ntap-20240329-0005"
        }
      ],
      "release_date": "2024-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-06-10T16:05:16+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHBA-2024:3779"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:2fdfbfea4ff28227250313161ff18ec02488bb0885f1f8c1246b2099dbb57aa3_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:8e222220dc1f757afeab58bf6f2f9452b5dbdaa3b320c600af0a24cb82364115_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:d6256f442de1c749a229b640f7f4c73c553ceaca56cab5c4445ff154692bcfc0_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-must-gather-rhel9@sha256:ed955951b37a54d2b8c5427483d59a75f79117a46f2da86e1cd5c05ba1e4de5c_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:7c2e8ec07b9732f0c9b15d6225f1907373f657229543d15b9f4817059cb1d6be_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:86fecc12917a9e5f0d3ba505d7d0a0ac46c159f504a3b22ce0c6e2582aa688b9_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:a7d8421822c6eb36af94a83fb83054834a953674a76b12d709de47cf31ed26b0_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-operator-bundle@sha256:bdab90659ff689082a40a2a68782ea253292d5536d1f7dbdef58d87483eeae93_arm64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:154c70cf0cbc54ec66b5cb742ae5bb0e00c4e16ebb635adacac301bd4823d308_s390x",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:217898714d0b7bb171246c338b48c8783c95f0c0ab5de0ce058887d3306d7c6b_ppc64le",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:3d87049a2e502f58d7f0dae1826dffbaf29c698aa220631734f27f1774fdae6b_amd64",
            "9Base-LVMS-4.15:lvms4/lvms-rhel9-operator@sha256:8dfcab499b6392f5d676baad6f3ab14509bc599b8f95e5c41e9cb9de30663598_arm64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:8b6df209c208bdff25add9e170ded058daaf97aab7e22f8915a9efb45362bb85_amd64",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:94fd0a6d39e074fc2f2970b595380224429c7b5ead953a2fb3602b2d6ba6fab3_ppc64le",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:dcb5555b9c859005f6f377d253578b614f7601f154e4f29b3e74ce93a1444fe3_s390x",
            "9Base-LVMS-4.15:lvms4/topolvm-rhel9@sha256:f1212b7301e7c9952a833dc30eb6e982709aa4ee182833c0aa57d6d2033b9f88_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm"
    }
  ]
}

CVE-2023-45290 (GCVE-0-2023-45290)

Vulnerability from cvelistv5 – Published: 2024-03-05 22:22 – Updated: 2025-02-13 17:14

Title

Memory exhaustion in multipart form parsing in net/textproto and net/http

Summary

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-06 15:04 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 64 records in the last 180 days details

References

6 references

URL	Tags
https://go.dev/issue/65383
https://go.dev/cl/569341
https://groups.google.com/g/golang-announce/c/5pw…
https://pkg.go.dev/vuln/GO-2024-2599
https://security.netapp.com/advisory/ntap-2024032…
http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/textproto	Affected: 0 , < 1.21.8 (semver) Affected: 1.22.0-0 , < 1.22.1 (semver)

Credits

Bartek Nowotarski

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45290",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T15:04:15.773941Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T11:07:13.798Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:21:15.331Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65383"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569341"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2599"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0004/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/textproto",
          "product": "net/textproto",
          "programRoutines": [
            {
              "name": "Reader.readLineSlice"
            },
            {
              "name": "Reader.readContinuedLineSlice"
            },
            {
              "name": "Reader.ReadCodeLine"
            },
            {
              "name": "Reader.ReadContinuedLine"
            },
            {
              "name": "Reader.ReadContinuedLineBytes"
            },
            {
              "name": "Reader.ReadDotLines"
            },
            {
              "name": "Reader.ReadLine"
            },
            {
              "name": "Reader.ReadLineBytes"
            },
            {
              "name": "Reader.ReadMIMEHeader"
            },
            {
              "name": "Reader.ReadResponse"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Bartek Nowotarski"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:46.260Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65383"
        },
        {
          "url": "https://go.dev/cl/569341"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2599"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0004/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Memory exhaustion in multipart form parsing in net/textproto and net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2023-45290",
    "datePublished": "2024-03-05T22:22:28.703Z",
    "dateReserved": "2023-10-06T17:06:26.221Z",
    "dateUpdated": "2025-02-13T17:14:02.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-24783 (GCVE-0-2024-24783)

Vulnerability from cvelistv5 – Published: 2024-03-05 22:22 – Updated: 2025-02-13 17:40

Title

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Summary

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-06 18:26 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 64 records in the last 180 days details

References

6 references

URL	Tags
https://go.dev/issue/65390
https://go.dev/cl/569339
https://groups.google.com/g/golang-announce/c/5pw…
https://pkg.go.dev/vuln/GO-2024-2598
https://security.netapp.com/advisory/ntap-2024032…
http://www.openwall.com/lists/oss-security/2024/03/08/4

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/x509	Affected: 0 , < 1.21.8 (semver) Affected: 1.22.0-0 , < 1.22.1 (semver)

Credits

John Howard (Google)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24783",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-06T18:26:26.163411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T16:57:46.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:12.597Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/65390"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569339"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2598"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240329-0005/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/x509",
          "product": "crypto/x509",
          "programRoutines": [
            {
              "name": "Certificate.buildChains"
            },
            {
              "name": "Certificate.Verify"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.21.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.22.1",
              "status": "affected",
              "version": "1.22.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "John Howard (Google)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-476: NULL Pointer Dereference",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T17:09:42.854Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/65390"
        },
        {
          "url": "https://go.dev/cl/569339"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2598"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240329-0005/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        }
      ],
      "title": "Verify panics on certificates with an unknown public key algorithm in crypto/x509"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24783",
    "datePublished": "2024-03-05T22:22:26.647Z",
    "dateReserved": "2024-01-30T16:05:14.757Z",
    "dateUpdated": "2025-02-13T17:40:23.803Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHBA-2024:3779

CVE-2023-45290 (GCVE-0-2023-45290)

CVE-2024-24783 (GCVE-0-2024-24783)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour