RHBA-2025:1479
Vulnerability from csaf_redhat - Published: 2025-02-13 19:21 - Updated: 2026-11-02 05:19Summary
Red Hat Bug Fix Advisory: Updated 5.3 container image is now available in the Red Hat Ecosystem Catalog.
Severity
Important
Notes
Topic: A new rhceph-5.3 container image is now available in the Red Hat Ecosystem Catalog.
Details: Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.
This new container image is based on Red Hat Ceph Storage 5.3 and Red Hat Enterprise Linux 9.5, 9.4, 9.3, 9.2, 9.1, 9.0, 8.10, 8.9, 8.8, 8.7, 8.6, 8.5, and EUS 8.4.
Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:
https://docs.redhat.com/en/documentation/red_hat_ceph_storage/5/html/5.3_release_notes
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permissions and global role assignments. After successful exploitation, an attacker who has the Organization Admin role in any organization can elevate their permissions across all organizations, elevate other users’ permissions in all organizations, or limit other users’ permissions in all organizations.
6.7 (Medium)
Affected products
Fixed
15 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
An authentication bypass vulnerability was found in the verify_email_enabled feature of Grafana. Even when enabled, this configuration option does not fully enforce email verification. This issue could allow a remote attacker that has authenticated with basic credentials to change the email address to use an unverified address. Successful exploitation could allow evasion of an organization's email domain filtering rules. An example of this is permitting a user in blocklisted countries or service providers to utilize a service.
5.4 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64 | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64 | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64 | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le | — |
Workaround
|
|
| Unresolved product id: 8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body (up to 1GiB), causing the receiver to fail reading the response, possibly leading to a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.
7.5 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Important
A vulnerability was found in Grafana. Due to an error in authorization logic, it is possible for an unprivileged user in a different organization other than the snapshot owner to perform unauthorized actions such as deleting it using a view key.
6.5 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
A flaw was found in Grafana, where setting the Grafana API Data Source UID to '*' Grants Unrestricted Access, grants a user the ability to set the UID to '*' via the Grafana API poses a severe security risk. This issue enables unauthorized access to read, query, edit, and delete all data sources within the organization. Such unrestricted access can lead to data breaches, manipulation, privacy violations, and compliance issues, emphasizing the critical importance of implementing stringent access controls and monitoring API usage.
6.0 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
Jose was found to have an uncontrolled resource consumption vulnerability. Under certain conditions, the user's environment can consume an unreasonable amount of CPU time or memory during JWE decryption operations, leading to a denial of service.
5.3 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.
4.3 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
A vulnerability was found in how Envoy Proxy implements the HTTP/2 codec. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which could use up compute resources to cause a Denial of Service.
5.3 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion.
5.9 (Medium)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Moderate
A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
7.5 (High)
Affected products
Fixed
15 products, the same list as for
CVE-2023-4822
Threats
Impact
Important
References
67 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new rhceph-5.3 container image is now available in the Red Hat Ecosystem Catalog.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. \n \nThis new container image is based on Red Hat Ceph Storage 5.3 and Red Hat Enterprise Linux 9.5, 9.4, 9.3, 9.2, 9.1, 9.0, 8.10, 8.9, 8.8, 8.7, 8.6, 8.5, and EUS 8.4.\n \nSpace precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes:\n\nhttps://docs.redhat.com/en/documentation/red_hat_ceph_storage/5/html/5.3_release_notes",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2025:1479",
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhba-2025_1479.json"
}
],
"title": "Red Hat Bug Fix Advisory: Updated 5.3 container image is now available in the Red Hat Ecosystem Catalog.",
"tracking": {
"current_release_date": "2026-11-02T05:19:00+00:00",
"generator": {
"date": "2026-11-02T05:19:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHBA-2025:1479",
"initial_release_date": "2025-02-13T19:21:25+00:00",
"revision_history": [
{
"date": "2025-02-13T19:21:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-13T19:21:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-02T05:19:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ceph Storage 5.3 Tools",
"product": {
"name": "Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ceph_storage:5.3::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ceph Storage"
},
{
"branches": [
{
"category": "product_version",
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"product": {
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"product_id": "rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/rhceph-5-dashboard-rhel8\u0026tag=5-97"
}
}
},
{
"category": "product_version",
"name": "rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"product": {
"name": "rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"product_id": "rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/keepalived-rhel8\u0026tag=2.1.5-44"
}
}
},
{
"category": "product_version",
"name": "rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"product": {
"name": "rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"product_id": "rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/rhceph-5-rhel8\u0026tag=5-535"
}
}
},
{
"category": "product_version",
"name": "rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"product": {
"name": "rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"product_id": "rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/rhceph-haproxy-rhel8\u0026tag=2.2.19-45"
}
}
},
{
"category": "product_version",
"name": "rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64",
"product": {
"name": "rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64",
"product_id": "rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f?arch=amd64\u0026repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel8\u0026tag=1.2.1-88"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"product": {
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"product_id": "rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/rhceph-5-dashboard-rhel8\u0026tag=5-97"
}
}
},
{
"category": "product_version",
"name": "rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"product": {
"name": "rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"product_id": "rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/keepalived-rhel8\u0026tag=2.1.5-44"
}
}
},
{
"category": "product_version",
"name": "rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"product": {
"name": "rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"product_id": "rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/rhceph-5-rhel8\u0026tag=5-535"
}
}
},
{
"category": "product_version",
"name": "rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"product": {
"name": "rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"product_id": "rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/rhceph-haproxy-rhel8\u0026tag=2.2.19-45"
}
}
},
{
"category": "product_version",
"name": "rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"product": {
"name": "rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"product_id": "rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416?arch=ppc64le\u0026repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel8\u0026tag=1.2.1-88"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"product": {
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"product_id": "rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/rhceph-5-dashboard-rhel8\u0026tag=5-97"
}
}
},
{
"category": "product_version",
"name": "rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"product": {
"name": "rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"product_id": "rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"product_identification_helper": {
"purl": "pkg:oci/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/keepalived-rhel8\u0026tag=2.1.5-44"
}
}
},
{
"category": "product_version",
"name": "rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"product": {
"name": "rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"product_id": "rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/rhceph-5-rhel8\u0026tag=5-535"
}
}
},
{
"category": "product_version",
"name": "rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"product": {
"name": "rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"product_id": "rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"product_identification_helper": {
"purl": "pkg:oci/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/rhceph-haproxy-rhel8\u0026tag=2.2.19-45"
}
}
},
{
"category": "product_version",
"name": "rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"product": {
"name": "rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"product_id": "rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8?arch=s390x\u0026repository_url=registry.redhat.io/rhceph/snmp-notifier-rhel8\u0026tag=1.2.1-88"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64 as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64"
},
"product_reference": "rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x"
},
"product_reference": "rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le"
},
"product_reference": "rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le"
},
"product_reference": "rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64 as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64"
},
"product_reference": "rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x"
},
"product_reference": "rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le"
},
"product_reference": "rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x"
},
"product_reference": "rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64 as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64"
},
"product_reference": "rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64 as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64"
},
"product_reference": "rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le"
},
"product_reference": "rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x"
},
"product_reference": "rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x"
},
"product_reference": "rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le"
},
"product_reference": "rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64 as a component of Red Hat Ceph Storage 5.3 Tools",
"product_id": "8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
},
"product_reference": "rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64",
"relates_to_product_reference": "8Base-RHCEPH-5.3-Tools"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Grafana Security Team"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2023-4822",
"discovery_date": "2023-09-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2239726"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permissions and global role assignments. After successful exploitation, an attacker who has the Organization Admin role in any organization can elevate their permissions across all organizations, elevate other users\u2019 permissions in all organizations, or limit other users\u2019 permissions in all organizations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: incorrect assessment of permissions across organizations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Only Grafana enterprise instances with more than one organization are vulnerable to this security issue. Red Hat does not ship enterprise versions of Grafana, therefore, Red Hat products are not affected by this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-4822"
},
{
"category": "external",
"summary": "RHBZ#2239726",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2239726"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-4822",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4822"
},
{
"category": "external",
"summary": "https://grafana.com/blog/2023/10/13/grafana-security-release-new-versions-of-grafana-with-a-medium-severity-security-fix-for-cve-2023-4822/",
"url": "https://grafana.com/blog/2023/10/13/grafana-security-release-new-versions-of-grafana-with-a-medium-severity-security-fix-for-cve-2023-4822/"
}
],
"release_date": "2023-10-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: incorrect assessment of permissions across organizations"
},
{
"cve": "CVE-2023-6152",
"cwe": {
"id": "CWE-302",
"name": "Authentication Bypass by Assumed-Immutable Data"
},
"discovery_date": "2024-01-30T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2262000"
}
],
"notes": [
{
"category": "description",
"text": "An authentication bypass vulnerability was found in the verify_email_enabled feature of Grafana. Even when enabled, this configuration option does not fully enforce email verification. This issue could allow a remote attacker that has authenticated with basic credentials to change the email address to use an unverified address. Successful exploitation could allow evasion of an organization\u0027s email domain filtering rules. An example of this is permitting a user in blocklisted countries or service providers to utilize a service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: email verification bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Use of Grafana basic authentication and the verify_email_enabled feature are preconditions for this vulnerability to affect your system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x"
],
"known_not_affected": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-6152"
},
{
"category": "external",
"summary": "RHBZ#2262000",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262000"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-6152",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-6152"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6152",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6152"
},
{
"category": "external",
"summary": "https://go.grafana.com/MzU2LVlGRy0zODkAAAGQ-uA6C7nzuSa-sr-ExDECDtkQsqBtkIPyWCp7OfehAPZ64TOkmW-HiQcbNpcFuB_YOIOgltA=",
"url": "https://go.grafana.com/MzU2LVlGRy0zODkAAAGQ-uA6C7nzuSa-sr-ExDECDtkQsqBtkIPyWCp7OfehAPZ64TOkmW-HiQcbNpcFuB_YOIOgltA="
},
{
"category": "external",
"summary": "https://grafana.com/blog/2024/02/14/grafana-security-release-medium-severity-security-fix-for-cve-2023-6152/",
"url": "https://grafana.com/blog/2024/02/14/grafana-security-release-medium-severity-security-fix-for-cve-2023-6152/"
}
],
"release_date": "2024-02-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: email verification bypass"
},
{
"cve": "CVE-2023-39326",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2023-12-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2253330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body (up to 1GiB), causing the receiver to fail reading the response, possibly leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-39326"
},
{
"category": "external",
"summary": "RHBZ#2253330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-39326",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39326"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-39326",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39326"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2023-2382",
"url": "https://pkg.go.dev/vuln/GO-2023-2382"
}
],
"release_date": "2023-12-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "No mitigation is available for this flaw.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests"
},
{
"acknowledgments": [
{
"names": [
"Bartek Nowotarski"
],
"organization": "nowotarski.info"
}
],
"cve": "CVE-2023-45288",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268273"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was discovered with the implementation of the HTTP/2 protocol in the Go programming language. There were insufficient limitations on the amount of CONTINUATION frames sent within a single stream. An attacker could potentially exploit this to cause a Denial of Service (DoS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the security impact of this vulnerability as Important due to the worst case scenario resulting in a denial of service. It is simple to exploit, could significantly impact availability, and there is not a suitable mitigation for all use cases. Once an attack has ended, the system should return to normal operations on its own.\n\nThis vulnerability only impacts servers which have HTTP/2 enabled. It stems from an imperfect definition of the protocol. As the Go programming language is widely utilized across nearly every major Red Hat offering, a full listing of impacted packages will not be provided. Therefore, the \u201cAffected Packages and Issued Red Hat Security Errata\u201d section contains a simplified list of what offerings need to remediate this vulnerability. Every impacted offering has at least one representative component listed, but potentially not all of them. Rest assured that Red Hat is committed to remediating this vulnerability across our entire portfolio.\n\nMany components are rated as Low impact due to configurations which reduce the attack surface or significantly increase the difficulty of exploitation. A summary of these scenarios are:\n* The container includes a package that provides a vulnerable webserver, but it is not used or running during operation\n* HTTP/2 is disabled by default and is not supported\n* Only a client implementation is provided, which is not vulnerable\n* A vulnerable module (either golang.org/net/http or golang.org/x/net/http2) is included, but disabled\n* Access to a vulnerable server is restricted within the container (loopback only connections)\n* Golang is available in the container but is not used\n\n\nWithin the Red Hat OpenShift Container Platform, the majority of vulnerable components are not externally accessible. This means an attacker must already have access to a container within your environment to exploit this vulnerability. However, the ose-hyperkube (openshift-enterprise-hyperkube) container is externally accessible, so there are less barriers to exploitation. Fixes for this specific container are already available.\n\nWithin Red Hat Ansible Automation Platform, the impacted component is Receptor. The impact has been reduced to Low as the vulnerable code is present, but not utilized. There are three potential exposures within this component:\n* Receptor utilizes QUIC a UDP based protocol which does not run over HTTP/2\n* Receptor utilizes the x/net/ipv4 and ipv6 packages, both of which are not affected",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "RHBZ#2268273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268273"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-45288",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45288"
},
{
"category": "external",
"summary": "https://nowotarski.info/http2-continuation-flood/",
"url": "https://nowotarski.info/http2-continuation-flood/"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-2687",
"url": "https://pkg.go.dev/vuln/GO-2024-2687"
},
{
"category": "external",
"summary": "https://www.kb.cert.org/vuls/id/421644",
"url": "https://www.kb.cert.org/vuls/id/421644"
}
],
"release_date": "2024-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS"
},
{
"cve": "CVE-2024-1313",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2024-03-27T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2271903"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Grafana. Due to an error in authorization logic, it is possible for an unprivileged user in a different organization other than the snapshot owner to perform unauthorized actions such as deleting it using a view key.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: vulnerable to authorization bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this as a Moderate impact flaw as it still require access to perform requests against Grafana and the view access key. The attacker would need minimum privileges in order to jeopardize an environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-1313"
},
{
"category": "external",
"summary": "RHBZ#2271903",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271903"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-1313",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1313"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-67rv-qpw2-6qrr",
"url": "https://github.com/advisories/GHSA-67rv-qpw2-6qrr"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-mh7p-8m2f-qrm6",
"url": "https://github.com/advisories/GHSA-mh7p-8m2f-qrm6"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2024-1313/",
"url": "https://grafana.com/security/security-advisories/cve-2024-1313/"
}
],
"release_date": "2024-03-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: vulnerable to authorization bypass"
},
{
"cve": "CVE-2024-1442",
"cwe": {
"id": "CWE-269",
"name": "Improper Privilege Management"
},
"discovery_date": "2024-03-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268486"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Grafana, where setting the Grafana API Data Source UID to \u0027*\u0027 Grants Unrestricted Access, grants a user the ability to set the UID to \u0027*\u0027 via the Grafana API poses a severe security risk. This issue enables unauthorized access to read, query, edit, and delete all data sources within the organization. Such unrestricted access can lead to data breaches, manipulation, privacy violations, and compliance issues, emphasizing the critical importance of implementing stringent access controls and monitoring API usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana: Improper priviledge managent for users with data source permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The issue of allowing users to set the UID to \u0027*\u0027 via the Grafana API presents a moderate severity concern due to its potential impact on data integrity and security within the organization\u0027s Grafana instance. While the risk of unauthorized access and data manipulation is significant, its severity is tempered by the prerequisite of having permission to create a data source in the first place. However, once exploited, this vulnerability enables an attacker to bypass access controls and gain unfettered access to all data sources, allowing them to read, query, edit, and delete sensitive information.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-1442"
},
{
"category": "external",
"summary": "RHBZ#2268486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-1442",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-1442"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1442",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1442"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-5mxf-42f5-j782",
"url": "https://github.com/advisories/GHSA-5mxf-42f5-j782"
}
],
"release_date": "2024-03-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "grafana: Improper priviledge managent for users with data source permissions"
},
{
"cve": "CVE-2024-28176",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-03-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268820"
}
],
"notes": [
{
"category": "description",
"text": "Jose was found to have an uncontrolled resource consumption vulnerability. Under certain conditions, the user\u0027s environment can consume an unreasonable amount of CPU time or memory during JWE decryption operations, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose: resource exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-28176"
},
{
"category": "external",
"summary": "RHBZ#2268820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-28176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28176"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-28176",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28176"
},
{
"category": "external",
"summary": "https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q",
"url": "https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q"
}
],
"release_date": "2024-03-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jose: resource exhaustion"
},
{
"cve": "CVE-2024-28180",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2024-03-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2268854"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jose-go: improper handling of highly compressed data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-28180"
},
{
"category": "external",
"summary": "RHBZ#2268854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268854"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-28180",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-28180"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-28180",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28180"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g"
}
],
"release_date": "2024-03-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jose-go: improper handling of highly compressed data"
},
{
"acknowledgments": [
{
"names": [
"Bartek Nowotarski"
],
"organization": "nowotarski.info"
}
],
"cve": "CVE-2024-30255",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2024-04-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2272986"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in how Envoy Proxy implements the HTTP/2 codec. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated remote attacker to send packets to vulnerable servers, which could use up compute resources to cause a Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the security impact of this vulnerability as Moderate, in alignment with upstream Envoy. The worst case scenario is excessive CPU utilization causing a denial of service. Once an attack has ended, the system should return to normal operations on its own.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-30255"
},
{
"category": "external",
"summary": "RHBZ#2272986",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272986"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-30255",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-30255"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-30255",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-30255"
},
{
"category": "external",
"summary": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm",
"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmm"
},
{
"category": "external",
"summary": "https://nowotarski.info/http2-continuation-flood/",
"url": "https://nowotarski.info/http2-continuation-flood/"
},
{
"category": "external",
"summary": "https://www.kb.cert.org/vuls/id/421644",
"url": "https://www.kb.cert.org/vuls/id/421644"
}
],
"release_date": "2024-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "envoy: HTTP/2 CPU exhaustion due to CONTINUATION frame flood"
},
{
"cve": "CVE-2024-34155",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-09-06T21:20:06.929766+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310527"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34155"
},
{
"category": "external",
"summary": "RHBZ#2310527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310527"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34155",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34155"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34155"
},
{
"category": "external",
"summary": "https://go.dev/cl/611238",
"url": "https://go.dev/cl/611238"
},
{
"category": "external",
"summary": "https://go.dev/issue/69138",
"url": "https://go.dev/issue/69138"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3105",
"url": "https://pkg.go.dev/vuln/GO-2024-3105"
}
],
"release_date": "2024-09-06T21:15:11.947000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion"
},
{
"cve": "CVE-2024-34156",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-09-06T21:20:09.377905+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310528"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the encoding/gob package of the Golang standard library. Calling Decoder.Decoding, a message that contains deeply nested structures, can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Go\u0027s `encoding/gob` package is of high severity because it exposes applications to potential Denial of Service (DoS) attacks through stack exhaustion. Since `gob` relies on recursive function calls to decode nested structures, an attacker could exploit this by sending crafted messages with excessively deep nesting, causing the application to panic due to stack overflow. This risk is particularly important in scenarios where untrusted or external input is processed, as it can lead to system unavailability or crashes, undermining the reliability and availability of services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34156"
},
{
"category": "external",
"summary": "RHBZ#2310528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310528"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34156",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34156"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34156",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34156"
},
{
"category": "external",
"summary": "https://go.dev/cl/611239",
"url": "https://go.dev/cl/611239"
},
{
"category": "external",
"summary": "https://go.dev/issue/69139",
"url": "https://go.dev/issue/69139"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk",
"url": "https://groups.google.com/g/golang-dev/c/S9POB9NCTdk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3106",
"url": "https://pkg.go.dev/vuln/GO-2024-3106"
}
],
"release_date": "2024-09-06T21:15:12.020000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-13T19:21:25+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2789521\n\nFor supported configurations, refer to:\n\nhttps://access.redhat.com/articles/1548993",
"product_ids": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2025:1479"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:55bc99f6ae2b2cfdba0388b07f702946c05aaf7ccefcdcaa21ce19a07a8f6e2b_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:804990858b8ff9d472a739b636b77ea34f941833b74755430d1fd925a6104905_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/keepalived-rhel8@sha256:f73ee4e4081f6ba34a744d46b826cdcea7be9b44367fa6bd17033f41e0e86501_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:01c532b8b12882583340be30b801674fccb669ba9e7dd85d6d2abae8566ad893_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:03c716fb65b9ec3c3503f12741302c7611bfef213fbbee15c8ed2b7b05b0fed6_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-dashboard-rhel8@sha256:9a9a9f0f166da4c5400a585ecd6b1e993106db332737fd8564256acb47042ee1_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:35914ebb22c38d485a1c3170ae483dab04314e042e2225c88674218dec255f5e_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:ea416a38f6f09598a142f8efd1c8ef9b3f704fe2b9df811e5ee162f0ddf1bf66_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-5-rhel8@sha256:eba2ea640eeb43dfaaee7112bc3bdc02825443e3d3f01949b4f3cf5764495d59_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:03c4faaabed7b7fb00bac44b3fe883b5a504013b5140abaf45c3ed493abfba1f_amd64",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:4570c28326cea2b3f325941e6f877ccdb556323e754bff629eb759e0ed66130c_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/rhceph-haproxy-rhel8@sha256:63178f0130b8ed6134da78610b25ce2bd56e8d3e885b6b86a05cc637b9132b35_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:202583f76439434ea1226ed0b8816ce0d15284bec5bd99aede5a6e2011a357c8_s390x",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:52c21de2d375af68a7025925e3eecb0c6c88a40a182b8e0c61ecc5900e6b1416_ppc64le",
"8Base-RHCEPH-5.3-Tools:rhceph/snmp-notifier-rhel8@sha256:7aee4534f100f79020f23f1a59b574b8f274229a70004dd49df587dc1ef14b2f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.