RHBA-2025:1076
Vulnerability from csaf_redhat - Published: 2025-02-06 09:08 - Updated: 2026-11-06 17:23Summary
Red Hat Bug Fix Advisory: Red Hat Quay v3.11.8 bug fix release
Severity
Important
Notes
Topic: Red Hat Quay 3.11.8 is now available with bug fixes.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Quay 3.11.8
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.
8.2 (High)
Affected products
Fixed
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.
7.3 (High)
Affected products
Fixed
30 products, the same list as for
CVE-2024-45337
Threats
Impact
Important
A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, storing a reference to a malicious string's format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.
6.3 (Medium)
Affected products
Fixed
30 products, the same list as for
CVE-2024-45337
Threats
Impact
Moderate
References
25 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.11.8 is now available with bug fixes.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.11.8",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:1076",
"url": "https://access.redhat.com/errata/RHBA-2025:1076"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_1076.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Quay v3.11.8 bug fix release",
"tracking": {
"current_release_date": "2026-11-06T17:23:30+00:00",
"generator": {
"date": "2026-11-06T17:23:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHBA-2025:1076",
"initial_release_date": "2025-02-06T09:08:29+00:00",
"revision_history": [
{
"date": "2025-02-06T09:08:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-06T09:08:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T17:23:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Quay v3",
"product": {
"name": "Quay v3",
"product_id": "8Base-Quay-3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"product_id": "quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"product": {
"name": "quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"product_id": "quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.11.8-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.11.8-3"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"product": {
"name": "quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"product_id": "quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"product_id": "quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"product": {
"name": "quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"product_id": "quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.11.8-10"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"product": {
"name": "quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"product_id": "quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"product": {
"name": "quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"product_id": "quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.11.8-4"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"product_id": "quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"product": {
"name": "quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"product_id": "quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.11.8-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.11.8-3"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"product": {
"name": "quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"product_id": "quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"product_id": "quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"product": {
"name": "quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"product_id": "quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.11.8-10"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"product": {
"name": "quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"product_id": "quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"product": {
"name": "quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"product_id": "quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.11.8-4"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"product": {
"name": "quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"product_id": "quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"product": {
"name": "quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"product_id": "quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"product": {
"name": "quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"product_id": "quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.11.8-4"
}
}
},
{
"category": "product_version",
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"product": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.11.8-3"
}
}
},
{
"category": "product_version",
"name": "quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"product": {
"name": "quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"product_id": "quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"product": {
"name": "quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"product_id": "quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"product": {
"name": "quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"product_id": "quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"product": {
"name": "quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"product_id": "quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.11.8-10"
}
}
},
{
"category": "product_version",
"name": "quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"product": {
"name": "quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"product_id": "quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.11.8-1"
}
}
},
{
"category": "product_version",
"name": "quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x",
"product": {
"name": "quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x",
"product_id": "quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.11.8-4"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x"
},
"product_reference": "quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le"
},
"product_reference": "quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64"
},
"product_reference": "quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x"
},
"product_reference": "quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64"
},
"product_reference": "quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64"
},
"product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64"
},
"product_reference": "quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le"
},
"product_reference": "quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x"
},
"product_reference": "quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64"
},
"product_reference": "quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64"
},
"product_reference": "quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le"
},
"product_reference": "quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x"
},
"product_reference": "quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x"
},
"product_reference": "quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64"
},
"product_reference": "quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le"
},
"product_reference": "quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64 as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64"
},
"product_reference": "quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le"
},
"product_reference": "quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"relates_to_product_reference": "8Base-Quay-3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x as a component of Quay v3",
"product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
},
"product_reference": "quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x",
"relates_to_product_reference": "8Base-Quay-3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45337",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2024-12-11T19:00:54.247490+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2331720"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the x/crypto/ssh go library. Applications and libraries that misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization bypass. For example, an attacker may send public keys A and B and authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B, for which the attacker does not control the private key. The misuse of ServerConfig.PublicKeyCallback may cause an authorization bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is classified as important rather than critical because it does not directly enable unauthorized access but rather introduces a risk of authorization bypass if the application or library misuses the PublicKeyCallback API. The vulnerability relies on incorrect assumptions made by the application when handling the sequence or state of keys provided during SSH authentication. Properly implemented systems that use the Permissions field or avoid relying on external state remain unaffected. Additionally, the vulnerability does not allow direct exploitation to gain control over a system without the presence of insecure logic in the application\u0027s handling of authentication attempts.\n\n\nRed Hat Enterprise Linux(RHEL) 8 \u0026 9 and Red Hat Openshift marked as not affected as it was determined that the problem function `ServerConfig.PublicKeyCallback`, as noted in the CVE-2024-45337 issue, is not called by Podman, Buildah, containers-common, or the gvisor-tap-vsock projects.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45337"
},
{
"category": "external",
"summary": "RHBZ#2331720",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331720"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45337",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45337"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45337"
},
{
"category": "external",
"summary": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909",
"url": "https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909"
},
{
"category": "external",
"summary": "https://go.dev/cl/635315",
"url": "https://go.dev/cl/635315"
},
{
"category": "external",
"summary": "https://go.dev/issue/70779",
"url": "https://go.dev/issue/70779"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ",
"url": "https://groups.google.com/g/golang-announce/c/-nPEi39gI4Q/m/cGVPJCqdAQAJ"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3321",
"url": "https://pkg.go.dev/vuln/GO-2024-3321"
}
],
"release_date": "2024-12-11T18:55:58.506000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-06T09:08:29+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1076"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto"
},
{
"cve": "CVE-2024-56201",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"discovery_date": "2024-12-23T16:00:38.768252+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333854"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja\u0027s sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja has a sandbox breakout through malicious filenames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has rated as a IMPORTANT flaw because an attacker controlling both the template content and filename to execute arbitrary Python code, bypassing the sandbox.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56201"
},
{
"category": "external",
"summary": "RHBZ#2333854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333854"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56201",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56201"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f",
"url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/issues/1792",
"url": "https://github.com/pallets/jinja/issues/1792"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
}
],
"release_date": "2024-12-23T15:37:36.110000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-06T09:08:29+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1076"
},
{
"category": "workaround",
"details": "To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jinja2: Jinja has a sandbox breakout through malicious filenames"
},
{
"cve": "CVE-2024-56326",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code"
},
"discovery_date": "2024-12-23T16:00:46.619763+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja\u0027s sandbox does catch calls to str.format and ensures they don\u0027t escape the sandbox. However, storing a reference to a malicious string\u0027s format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja has a sandbox breakout through indirect reference to format method",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate due to an oversight in Jinja\u0027s sandbox environment, allowing attackers to execute arbitrary Python code through controlled template content. This requires control over template content, making exploitation possible only in specific applications, thus limiting its overall impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56326"
},
{
"category": "external",
"summary": "RHBZ#2333856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56326",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56326"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4",
"url": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
}
],
"release_date": "2024-12-23T15:43:49.400000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-06T09:08:29+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1076"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-Quay-3:quay/clair-rhel8@sha256:934e57a5bc41934ac3abb5648f13095a1706bc3b9c5a35b7cf165a21c8d86e37_s390x",
"8Base-Quay-3:quay/clair-rhel8@sha256:c5b2fd5c9816e23e2183cf392e2780c876ebe54803950b314de725d0c2da7c9e_ppc64le",
"8Base-Quay-3:quay/clair-rhel8@sha256:eea0af6763e284a749a27e058ddaa6163122cab96ab5314b072eae5d278128d4_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:8563f13509077928327713a4e21c496308f331f02de77c5239666d8894c238ea_amd64",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:b248301da7dca14d8ec891fd6f46edcb52ef2f25b035d0a8d2904f7ba63076ea_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:fcddf6cf42d9ea6719bd76f155731b6cb5106e758acb7f68459006b9fe57c1ab_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9b6c8ca1278fc1ff898c1637960648879f55f662a7210b462da757c2b4329e4c_s390x",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:9cbabc6a5123636a773ded78e49d39d394aec71137556b702d537ada59fece95_ppc64le",
"8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:dce5c56a88e6cd047a6598214d26f31d1c3e718ea74bff4f481b93da62f1ef2a_amd64",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:a2e2d5bbccb44592b645240d8b4e78f8c0a51f44230bedbc267da11d8bede5d2_ppc64le",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbd29b649ab48582d0e4fab0f379372c3a2342d38191f8553fd83ac1fbb03ced_s390x",
"8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:dbeb4246634f6e448196abc419b823df8e24a1183c9ae481cd7f888261815b87_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:41a0239d0cf3cf584589941a355d8865c9c85aee2fe0caf3ed4ac547690cb2b4_amd64",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:a7bcfb218bbaba2d108eaba70903011365798760676ca08004308f5ddf67d0de_ppc64le",
"8Base-Quay-3:quay/quay-builder-rhel8@sha256:f9f8e2ebdd89de4681462181ebd1ee4bae20e247e4d85fe83ced7927ca834aae_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:0c89e80541fb5d3f8b039c1eec11f3d66e2d8bed45957a7d06e5ccab4c84c8bb_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:5b7f134fd97aaa8a2de7c9932c90535e73b6e7e988d3a6b901b3b7ea24f61fb8_amd64",
"8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:a932a9f221a720ce985f9f5b45c423967c34ecac57526bcec20ab036de054a4a_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1b19b373308e03255c5eafb3138e4fd68f4eeb5b8882fc55a5ba3d1bd54dbfd4_ppc64le",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:4e3b6c7cb11891ce9f36febfe85af45ed2fd350598c9274e5e83812a4e392699_s390x",
"8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:cc88bed83ed8f2546508f32224f6c330fa02be68d4df958feff9b3011fbbe553_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:48457a0cf0759d88bf0a0b93e299df6849480c331225f93bab77cd6864b432a2_amd64",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:65eb35f7a51418bb619ac5277b9e98abb1409bb1b64976e76344c691e9c3859e_ppc64le",
"8Base-Quay-3:quay/quay-operator-bundle@sha256:e32fb7c37cbc2d4a98256cfa5562f550b9b29453fe7a362fd95bd04cd77d7323_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:48bf195e9bd37edd7a6907c09b2705258524d93f5ace63291e5d8fd378c0f650_s390x",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:b033800b3514e263cfb4709a9e1ade07e9882998fb88a4aa8d99f2d14735a5fd_amd64",
"8Base-Quay-3:quay/quay-operator-rhel8@sha256:f6b9158a394f426d8ecf99a8fd5e8b396c0f75e040c4935caaa0f301e7266155_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:00a9ab9874d4731fd30549ebe29775483973e993f22d9e783bad24228b23d9c6_amd64",
"8Base-Quay-3:quay/quay-rhel8@sha256:7b3ddd6767959437bca2c5873f0ba460486ed1757259eb47c551d9b10fa7900f_ppc64le",
"8Base-Quay-3:quay/quay-rhel8@sha256:99cbbc05988d41557eeee7c04a835caf64638d4698aa9da6b89499222a791d4f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jinja2: Jinja has a sandbox breakout through indirect reference to format method"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.