RHBA-2024:4181
Vulnerability from csaf_redhat - Published: 2024-07-01 03:59 - Updated: 2026-11-08 05:01Summary
Red Hat Bug Fix Advisory: LVMS 4.16 Bug Fix and Enhancement update
Severity
Important
Notes
Topic: Updated container images that add new features and fix multiple bugs are
now available for LVMS 4.16
Details: Logical volume manager storage creates thin-provisioned volumes using the
Logical Volume Manager and provides dynamic provisioning of block storage
on a cluster.
Enhancement(s):
- Support for configuring thick-provisioned storage - This feature provides support for configuring thick-provisioned storage. If you exclude the deviceClasses.thinPoolConfig field in the LVMCluster custom resource (CR), logical volumes are thick provisioned. Thick provisioned volumes do no support volume cloning and VolumeSnapshotClass. Therefore, CSI snapshotting is not supported.
- Support for a new warning message when device selector is not configured in the LVMCluster custom resource - This update provides a new warning message when you do not configure the deviceSelector field in the LVMCluster CR.
- Support for adding encrypted devices to a volume group - This feature provides support for adding encrypted devices to a volume group. With this release, you can specify the path to the LUKS encrypted device in the deviceSelector field in the LVMCluster CR.
This erratum corrects the following issues:
- Previously, some LVMVolumeGroupNodeStatus operands were not deleted on the cluster during the deletion of the LVMCluster CR. With this release, deleting the LVMCluster CR triggers the deletion of all the LVMVolumeGroupNodeStatus operands.
- Previously, LVM Storage uninstallation was stuck waiting for the deletion of the LVMVolumeGroupNodeStatus operands. This fix corrects the behavior by ensuring all operands are deleted, allowing LVM Storage to be uninstalled without delay.
- Previously, LVM Storage created persistent volume claims (PVCs) with storage size requests that were not multiples of the disk sector size. This can cause issues during LVM2 volume creation. This fix corrects the behavior by rounding the storage size requested by PVCs to the nearest multiple of 512.
- Previously, the LVMCluster CR contained an excluded status element for a device that is set up correctly. This fix filters the correctly set device from being considered for an excluded status element, so it only appears in the ready devices.
- Previously, LVM Storage did not support minimum storage size for persistent volume claims (PVCs). This can lead to mount failures while provisioning PVCs. With this release, LVM Storage supports minimum storage size for PVCs. The following are the minimum storage sizes that you can request for each file system type: block: 8 MiB, xfs: 300 MiB, ext4: 32 MiB
- Previously, TopoLVM did not have a file watcher for the lvmd configuration. As a result, any updates to the lvmd configuration were not applied until the next restart. With this release, the lvmd configuration on nodes running LVMS is hot-reloaded. This triggers a restart of LVMS when changes to the lvmd configuration are detected.
- Previously, the TopoLVM controllers deployed during LVMCluster CR setup were separate from the LVMS controllers. As a result, memory and CPU usage were higher. With this release, the TopoLVM controllers have been merged into the LVMS controllers, significantly reducing memory and CPU usage.
After a successful LVMS upgrade, the latest lvms-operator SHA image should be seen.
Users of LVMS are advised to upgrade to the latest version in OpenShift Container Platform, which fixes these bugs and adds these enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.
7.5 (High)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was discovered in Go's net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
5.3 (Medium)
Affected products
Fixed
16 products, the same list as for
CVE-2023-45288
Threats
Impact
Moderate
A flaw was found in Go's crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.
5.9 (Medium)
Affected products
Fixed
16 products, the same list as for
CVE-2023-45288
Threats
Impact
Moderate
References
51 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated container images that add new features and fix multiple bugs are\nnow available for LVMS 4.16",
"title": "Topic"
},
{
"category": "general",
"text": "Logical volume manager storage creates thin-provisioned volumes using the\nLogical Volume Manager and provides dynamic provisioning of block storage\non a cluster.\n\nEnhancement(s):\n\n- Support for configuring thick-provisioned storage - This feature provides support for configuring thick-provisioned storage. If you exclude the deviceClasses.thinPoolConfig field in the LVMCluster custom resource (CR), logical volumes are thick provisioned. Thick provisioned volumes do no support volume cloning and VolumeSnapshotClass. Therefore, CSI snapshotting is not supported.\n\n- Support for a new warning message when device selector is not configured in the LVMCluster custom resource - This update provides a new warning message when you do not configure the deviceSelector field in the LVMCluster CR. \n\n- Support for adding encrypted devices to a volume group - This feature provides support for adding encrypted devices to a volume group. With this release, you can specify the path to the LUKS encrypted device in the deviceSelector field in the LVMCluster CR. \n\nThis erratum corrects the following issues:\n\n- Previously, some LVMVolumeGroupNodeStatus operands were not deleted on the cluster during the deletion of the LVMCluster CR. With this release, deleting the LVMCluster CR triggers the deletion of all the LVMVolumeGroupNodeStatus operands.\n\n- Previously, LVM Storage uninstallation was stuck waiting for the deletion of the LVMVolumeGroupNodeStatus operands. This fix corrects the behavior by ensuring all operands are deleted, allowing LVM Storage to be uninstalled without delay. \n\n- Previously, LVM Storage created persistent volume claims (PVCs) with storage size requests that were not multiples of the disk sector size. This can cause issues during LVM2 volume creation. This fix corrects the behavior by rounding the storage size requested by PVCs to the nearest multiple of 512. \n\n- Previously, the LVMCluster CR contained an excluded status element for a device that is set up correctly. This fix filters the correctly set device from being considered for an excluded status element, so it only appears in the ready devices. \n\n- Previously, LVM Storage did not support minimum storage size for persistent volume claims (PVCs). This can lead to mount failures while provisioning PVCs. With this release, LVM Storage supports minimum storage size for PVCs. The following are the minimum storage sizes that you can request for each file system type: block: 8 MiB, xfs: 300 MiB, ext4: 32 MiB\n\n- Previously, TopoLVM did not have a file watcher for the lvmd configuration. As a result, any updates to the lvmd configuration were not applied until the next restart. With this release, the lvmd configuration on nodes running LVMS is hot-reloaded. This triggers a restart of LVMS when changes to the lvmd configuration are detected.\n\n- Previously, the TopoLVM controllers deployed during LVMCluster CR setup were separate from the LVMS controllers. As a result, memory and CPU usage were higher. With this release, the TopoLVM controllers have been merged into the LVMS controllers, significantly reducing memory and CPU usage.\n\nAfter a successful LVMS upgrade, the latest lvms-operator SHA image should be seen.\n \nUsers of LVMS are advised to upgrade to the latest version in OpenShift Container Platform, which fixes these bugs and adds these enhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2024:4181",
"url": "https://access.redhat.com/errata/RHBA-2024:4181"
},
{
"category": "external",
"summary": "OCPBUGS-26502",
"url": "https://issues.redhat.com/browse/OCPBUGS-26502"
},
{
"category": "external",
"summary": "OCPBUGS-27095",
"url": "https://issues.redhat.com/browse/OCPBUGS-27095"
},
{
"category": "external",
"summary": "OCPBUGS-27226",
"url": "https://issues.redhat.com/browse/OCPBUGS-27226"
},
{
"category": "external",
"summary": "OCPBUGS-27331",
"url": "https://issues.redhat.com/browse/OCPBUGS-27331"
},
{
"category": "external",
"summary": "OCPBUGS-27365",
"url": "https://issues.redhat.com/browse/OCPBUGS-27365"
},
{
"category": "external",
"summary": "OCPBUGS-27956",
"url": "https://issues.redhat.com/browse/OCPBUGS-27956"
},
{
"category": "external",
"summary": "OCPBUGS-28975",
"url": "https://issues.redhat.com/browse/OCPBUGS-28975"
},
{
"category": "external",
"summary": "OCPBUGS-29188",
"url": "https://issues.redhat.com/browse/OCPBUGS-29188"
},
{
"category": "external",
"summary": "OCPBUGS-29225",
"url": "https://issues.redhat.com/browse/OCPBUGS-29225"
},
{
"category": "external",
"summary": "OCPBUGS-30032",
"url": "https://issues.redhat.com/browse/OCPBUGS-30032"
},
{
"category": "external",
"summary": "OCPBUGS-30266",
"url": "https://issues.redhat.com/browse/OCPBUGS-30266"
},
{
"category": "external",
"summary": "OCPBUGS-30346",
"url": "https://issues.redhat.com/browse/OCPBUGS-30346"
},
{
"category": "external",
"summary": "OCPBUGS-30830",
"url": "https://issues.redhat.com/browse/OCPBUGS-30830"
},
{
"category": "external",
"summary": "OCPBUGS-32268",
"url": "https://issues.redhat.com/browse/OCPBUGS-32268"
},
{
"category": "external",
"summary": "OCPBUGS-32753",
"url": "https://issues.redhat.com/browse/OCPBUGS-32753"
},
{
"category": "external",
"summary": "OCPBUGS-32954",
"url": "https://issues.redhat.com/browse/OCPBUGS-32954"
},
{
"category": "external",
"summary": "OCPBUGS-33026",
"url": "https://issues.redhat.com/browse/OCPBUGS-33026"
},
{
"category": "external",
"summary": "OCPBUGS-35404",
"url": "https://issues.redhat.com/browse/OCPBUGS-35404"
},
{
"category": "external",
"summary": "OCPEDGE-27",
"url": "https://issues.redhat.com/browse/OCPEDGE-27"
},
{
"category": "external",
"summary": "OCPEDGE-60",
"url": "https://issues.redhat.com/browse/OCPEDGE-60"
},
{
"category": "external",
"summary": "OCPEDGE-689",
"url": "https://issues.redhat.com/browse/OCPEDGE-689"
},
{
"category": "external",
"summary": "OCPEDGE-82",
"url": "https://issues.redhat.com/browse/OCPEDGE-82"
},
{
"category": "external",
"summary": "OCPEDGE-999",
"url": "https://issues.redhat.com/browse/OCPEDGE-999"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_4181.json"
}
],
"title": "Red Hat Bug Fix Advisory: LVMS 4.16 Bug Fix and Enhancement update",
"tracking": {
"current_release_date": "2026-11-08T05:01:02+00:00",
"generator": {
"date": "2026-11-08T05:01:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHBA-2024:4181",
"initial_release_date": "2024-07-01T03:59:25+00:00",
"revision_history": [
{
"date": "2024-07-01T03:59:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2024-07-01T03:59:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-08T05:01:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "LVMS 4.16 for RHEL 9",
"product": {
"name": "LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:lvms:4.16::el9"
}
}
}
],
"category": "product_family",
"name": "logical volume manager storage"
},
{
"branches": [
{
"category": "product_version",
"name": "lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"product": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"product_id": "lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.16.0-46"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"product": {
"name": "lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"product_id": "lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.16.0-60"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"product": {
"name": "lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"product_id": "lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.16.0-50"
}
}
},
{
"category": "product_version",
"name": "lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"product": {
"name": "lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"product_id": "lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.16.0-26"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"product": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"product_id": "lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.16.0-46"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"product": {
"name": "lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"product_id": "lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.16.0-60"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"product": {
"name": "lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"product_id": "lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.16.0-50"
}
}
},
{
"category": "product_version",
"name": "lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le",
"product": {
"name": "lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le",
"product_id": "lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.16.0-26"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"product": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"product_id": "lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.16.0-46"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"product": {
"name": "lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"product_id": "lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.16.0-60"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"product": {
"name": "lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"product_id": "lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.16.0-50"
}
}
},
{
"category": "product_version",
"name": "lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"product": {
"name": "lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"product_id": "lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"product_identification_helper": {
"purl": "pkg:oci/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.16.0-26"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"product": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"product_id": "lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel9\u0026tag=v4.16.0-46"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"product": {
"name": "lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"product_id": "lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=v4.16.0-60"
}
}
},
{
"category": "product_version",
"name": "lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"product": {
"name": "lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"product_id": "lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel9-operator\u0026tag=v4.16.0-50"
}
}
},
{
"category": "product_version",
"name": "lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"product": {
"name": "lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"product_id": "lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"product_identification_helper": {
"purl": "pkg:oci/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel9\u0026tag=v4.16.0-26"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64"
},
"product_reference": "lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x"
},
"product_reference": "lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64"
},
"product_reference": "lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le"
},
"product_reference": "lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x"
},
"product_reference": "lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le"
},
"product_reference": "lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64"
},
"product_reference": "lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64"
},
"product_reference": "lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x"
},
"product_reference": "lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64"
},
"product_reference": "lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64"
},
"product_reference": "lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le"
},
"product_reference": "lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x"
},
"product_reference": "lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64"
},
"product_reference": "lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64 as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64"
},
"product_reference": "lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"relates_to_product_reference": "9Base-LVMS-4.16"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le as a component of LVMS 4.16 for RHEL 9",
"product_id": "9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
},
"product_reference": "lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le",
"relates_to_product_reference": "9Base-LVMS-4.16"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Bartek Nowotarski"
],
"organization": "nowotarski.info"
}
],
"cve": "CVE-2023-45288",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268273"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "RHBZ#2268273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
},
{
"category": "external",
"summary": "https://nowotarski.info/http2-continuation-flood/",
"url": "https://nowotarski.info/http2-continuation-flood/"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2687",
"url": "https://pkg.go.dev/vuln/GO-2024-2687"
},
{
"category": "external",
"summary": "https://www.kb.cert.org/vuls/id/421644",
"url": "https://www.kb.cert.org/vuls/id/421644"
}
],
"release_date": "2024-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-07-01T03:59:25+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2024:4181"
},
{
"category": "workaround",
"details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.",
"product_ids": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS"
},
{
"cve": "CVE-2023-45290",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was discovered in Go\u0027s net/http standard library package. When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45290"
},
{
"category": "external",
"summary": "RHBZ#2268017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45290",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45290"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
},
{
"category": "external",
"summary": "https://go.dev/cl/569341",
"url": "https://go.dev/cl/569341"
},
{
"category": "external",
"summary": "https://go.dev/issue/65383",
"url": "https://go.dev/issue/65383"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2599",
"url": "https://pkg.go.dev/vuln/GO-2024-2599"
},
{
"category": "external",
"summary": "https://security.netapp.com/advisory/ntap-20240329-0004",
"url": "https://security.netapp.com/advisory/ntap-20240329-0004"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-07-01T03:59:25+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2024:4181"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm"
},
{
"cve": "CVE-2024-24783",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2024-03-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268019"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s crypto/x509 standard library package. Verifying a certificate chain that contains a certificate with an unknown public key algorithm will cause a Certificate.Verify to panic. This issue affects all crypto/tls clients and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-24783"
},
{
"category": "external",
"summary": "RHBZ#2268019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268019"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-24783",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-24783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24783"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2024/03/08/4",
"url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp",
"url": "https://github.com/advisories/GHSA-3q2c-pvp5-3cqp"
},
{
"category": "external",
"summary": "https://go.dev/cl/569339",
"url": "https://go.dev/cl/569339"
},
{
"category": "external",
"summary": "https://go.dev/issue/65390",
"url": "https://go.dev/issue/65390"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg",
"url": "https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2598",
"url": "https://pkg.go.dev/vuln/GO-2024-2598"
},
{
"category": "external",
"summary": "https://security.netapp.com/advisory/ntap-20240329-0005",
"url": "https://security.netapp.com/advisory/ntap-20240329-0005"
}
],
"release_date": "2024-03-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2024-07-01T03:59:25+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2024:4181"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:2d08ac1c23654cb0899cd7e77efb19c637fbbb3fbb188e5d269738d47e1f8703_arm64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:31824d8183abcdaa5e6e71fa7e090f4b250e3b318a2192a6c206a5704d9081fe_s390x",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fd758e7a61424e66643cb0c27659395f47c36c9dc6ffa698187f21b6572a65bd_amd64",
"9Base-LVMS-4.16:lvms4/lvms-must-gather-rhel9@sha256:fdebaacfb1092232279413ea2b371afc696873d6f16d1102994791d5f8119dc3_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:83a2f71f04972c2df2e354ee3ef10664d5cc0159fc72d0d5ff904335e6367a8f_s390x",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:dcd945e0242143e3189e36d30ff52e458cb11bf171ed33516744fd5d5932b224_ppc64le",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:e6cba2a6bfd968423449e5091cc64b968d8a0b6aa34430c527ce655d91f1da35_arm64",
"9Base-LVMS-4.16:lvms4/lvms-operator-bundle@sha256:eb2e7f3c015035164e4d1103493b7221f5623db5a6bd63851dd462ea457e378c_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:278b55be190ff6e10881fbd628bc99cbf8db3676eec9d37eb6a810b843f4fcab_s390x",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:3a7c23e201ae05bff7cbbf22e457e10182f208c10f9c6456c2191e0cac9eef35_amd64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:a0eb9461bac83d5920a8756456f5b8e5850fa976119414c984bcfb210a09e039_arm64",
"9Base-LVMS-4.16:lvms4/lvms-rhel9-operator@sha256:f48dff6e47baf1b92c72fc1ed4138bb03e91841d45207d909c5a2fa5bda381a3_ppc64le",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:0276c52c14e801855aa7dba9fae9e2cfbe3b94773adf90e5069c17be9de31450_s390x",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:5066739b4af718009ca104d7ec6cf732186ab833c110565954fb9b535c9761ac_amd64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:8dabcb1f27251be66d6e0e9f5b12804af8779fe4ee5e07cf99e3ac515c9e0ff8_arm64",
"9Base-LVMS-4.16:lvms4/topolvm-rhel9@sha256:d69e916f98ebb966c0812f1a02ca1be56a6e25884c6631ee4471a8aad9630721_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.