RHBA-2025:0250
Vulnerability from csaf_redhat - Published: 2025-01-15 11:59 - Updated: 2026-11-06 07:33Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.12.7 bug fix release
Severity
Important
Notes
Topic: Red Hat Quay 3.12.7 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.12.7
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
8.2 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.
7.3 (High)
Affected products
Fixed
30 products, the same list as for
CVE-2024-45337
Threats
Impact
Important
A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, storing a reference to a malicious string's format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.
6.3 (Medium)
Affected products
Fixed
30 products, the same list as for
CVE-2024-45337
Threats
Impact
Moderate
References
25 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.12.7 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.12.7",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:0250",
"url": "https://access.redhat.com/errata/RHBA-2025:0250"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_0250.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.12.7 bug fix release",
"tracking": {
"current_release_date": "2026-11-06T07:33:40+00:00",
"generator": {
"date": "2026-11-06T07:33:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHBA-2025:0250",
"initial_release_date": "2025-01-15T11:59:16+00:00",
"revision_history": [
{
"date": "2025-01-15T11:59:16+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-01-15T11:59:16+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T07:33:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"product_id": "quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"product": {
"name": "quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"product_id": "quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.12.7-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"product": {
"name": "quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"product_id": "quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"product_id": "quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"product": {
"name": "quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"product_id": "quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.12.7-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"product": {
"name": "quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"product_id": "quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.12.7-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"product": {
"name": "quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"product_id": "quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.12.7-5"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.12.7-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"product_id": "quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"product_id": "quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.12.7-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.12.7-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"product_id": "quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.12.7-5"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"product_id": "quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"product": {
"name": "quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"product_id": "quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.12.7-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"product": {
"name": "quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"product_id": "quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"product_id": "quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.12.7-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"product": {
"name": "quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"product_id": "quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.12.7-7"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"product": {
"name": "quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"product_id": "quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.12.7-2"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le",
"product": {
"name": "quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le",
"product_id": "quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.12.7-5"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x"
},
"product_reference": "quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le"
},
"product_reference": "quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le"
},
"product_reference": "quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x"
},
"product_reference": "quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le"
},
"product_reference": "quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x"
},
"product_reference": "quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le"
},
"product_reference": "quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x"
},
"product_reference": "quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x"
},
"product_reference": "quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
},
"product_reference": "quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45337",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2024-12-11T19:00:54.247490+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2331720"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is classified as important rather than critical because it does not directly enable unauthorized access but rather introduces a risk of authorization bypass if the application or library misuses the PublicKeyCallback API. The vulnerability relies on incorrect assumptions made by the application when handling the sequence or state of keys provided during SSH authentication. Properly implemented systems that use the Permissions field or avoid relying on external state remain unaffected. Additionally, the vulnerability does not allow direct exploitation to gain control over a system without the presence of insecure logic in the application\u0027s handling of authentication attempts.\n\n\nRed Hat Enterprise Linux(RHEL) 8 \u0026 9 and Red Hat Openshift marked as not affected as it was determined that the problem function `ServerConfig.PublicKeyCallback`, as noted in the CVE-2024-45337 issue, is not called by Podman, Buildah, containers-common, or the gvisor-tap-vsock projects.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45337"
},
{
"category": "external",
"summary": "RHBZ#2331720",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331720"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337"
},
{
"category": "external",
"summary": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909",
"url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
},
{
"category": "external",
"summary": "https://go.dev/cl/635315",
"url": "https://go.dev/cl/635315"
},
{
"category": "external",
"summary": "https://go.dev/issue/70779",
"url": "https://go.dev/issue/70779"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ",
"url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3321",
"url": "https://pkg.go.dev/vuln/GO-2024-3321"
}
],
"release_date": "2024-12-11T18:55:58.506000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-01-15T11:59:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:0250"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"
},
{
"cve": "CVE-2024-56201",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"discovery_date": "2024-12-23T16:00:38.768252+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333854"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja\u0027s sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja has a sandbox breakout through malicious filenames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has rated as a IMPORTANT flaw because an attacker controlling both the template content and filename to execute arbitrary Python code, bypassing the sandbox.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56201"
},
{
"category": "external",
"summary": "RHBZ#2333854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333854"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56201",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56201"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f",
"url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/issues/1792",
"url": "https://github.com/pallets/jinja/issues/1792"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
}
],
"release_date": "2024-12-23T15:37:36.110000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-01-15T11:59:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:0250"
},
{
"category": "workaround",
"details": "To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jinja2: Jinja has a sandbox breakout through malicious filenames"
},
{
"cve": "CVE-2024-56326",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code"
},
"discovery_date": "2024-12-23T16:00:46.619763+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja\u0027s sandbox does catch calls to str.format and ensures they don\u0027t escape the sandbox. However, storing a reference to a malicious string\u0027s format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja has a sandbox breakout through indirect reference to format method",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate due to an oversight in Jinja\u0027s sandbox environment, allowing attackers to execute arbitrary Python code through controlled template content. This requires control over template content, making exploitation possible only in specific applications, thus limiting its overall impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56326"
},
{
"category": "external",
"summary": "RHBZ#2333856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56326",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56326"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4",
"url": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
}
],
"release_date": "2024-12-23T15:43:49.400000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-01-15T11:59:16+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:0250"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:0c8068d85e79410b5cf90052904ecc1f22aa596145e8511f4980bad61ea8bb32_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:6d86f13901d8cd7c4c7ccc2e8736716ff6b30414cfb49256844952d86f56f0a8_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:d3203c3768cb46330a695be1dcdd6f52831d0096a6931d2dbfa1c2c782ed6980_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:05cf4e92497b825f8da591bfd2af90da29abf84450906acfa8db16f2679750d2_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:36bbc999dcf05c91b7504f053b5c7f56f5c34d0783c46497a24c04fa43296c64_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:40c83f4c53c4a7e21375e96d6eb66f11fca86b9c139ff1cdfd2dcda0aac28884_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:87caae49038fec19f22e0e9ac6748bf5a8c08c9c0a5d4818fdc28a87ba8fd8f5_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:c4e00ce54bd1616c055db7f837fc177f1ad400ecf4f926e1f7c523918db1e945_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:f84497e856179a6790125fa823894a7eecc1a56565455dce17e7e55562b2781f_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:07e65529d3ac7a7cfbce4c60e97c31f2bfcb56232a207b16eb25946b135dcb56_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:ef968a1177abe7c48fe93dc8202ba2c3cddc1e54b5f49f6f695b5098d6b6583b_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:f73abdb868e3e675b3cd38054292976a7c4757acf857965540ada687c485d75a_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:243f2640dc6d07bb387dabaf2cb08012c30db2ac8d1b74f15a335459bfd36a7a_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:95a87f2c2a76f5647d82a0ddc708aeb89351067a5a11c122a5935b3f0c40997b_s390x",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f8ea2413a3da488fc09fb4a306d2bda16eda328d535a2c1cf2e603f2989b7da1_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:8216ec9e9c11b5215159b7e21e8cbd6a3238353218dd5de8ed6f9ff2ebed5991_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:838deb2355861914e34d3155ded9aecb475ea2f0b9e655cc2710347f4d6c8d87_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:f9f8e8ef8487f5f471d92cf7c43a652b51b6a624a96c4fd53e03e0c6d9d10968_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1f3054efe47978df7b5a9fdf64ab8e2094344f9f11544d8d4d993942fd9810e2_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:5e4c25c423a82cfd5d033d29ce48c403abae46c1f4ff6676b1e0d7288255bcbc_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:d835def577b2f648c185f8d18a38263355f2f527297f223159fb863c459214d6_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:3bdce7b1dc65ee8be1a77b74111a763860e837aec4454e1f3b65d0e2f2feb24e_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:8465c90b84c41a8eac4e92cb7a3120cc56ff5e4aa498fa8d94c332c513d61e36_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:c2ad9b871aab7517a77c0961b720365695677caf8b370ef38860c4d31ff7d20d_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:358734bebe1b998bee9e99c04bf27c8cd9494723a2d43a97bc0fa162acf9807b_ppc64le",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:53e6569b7cc65013be174adf1fa233c26873fa8ed6a617ec2019faf282ae05d3_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:e0b518b5a6a56256444ac91c6abc48ec55d26d82cc553447b7957432905ce78f_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:34a5802123bd6178496c5a0ed5f0b34893d9505d27895d8859a8e373209e6608_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:698d9dd4b372343e154bff8bf2205c1929bc05d78be1186723deeaf8c6580ff4_s390x",
"8Base-Quay-3:quay/quay-rhel8@sha256:9b6bc08c1bdfa17ef7408adb7ae611441bdc4a4a9c3b3cb0509d19ec0a99be3e_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jinja2: Jinja has a sandbox breakout through indirect reference to format method"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.