Vulnerability-Lookup

RHSA-2026:59439

Vulnerability from csaf_redhat - Published: 2026-08-25 13:53 - Updated: 2026-08-27 15:29

Summary

Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release

Severity

Important

Notes

Topic: The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

Details: The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum. It is also possible to force a derived key to be all zeros instead of an unpredictable value. This may have follow-on implications for the Go TLS stack.

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

CWE-457 - Use of Uninitialized Variable

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64		—	Vendor Fix fix Workaround

Known not affected 9 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64	—	Workaround

Threats

Impact Moderate

CVE-2025-7783

A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data. This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation.

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE-330 - Use of Insufficiently Random Values

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64		—	Vendor Fix fix Workaround

Known not affected 9 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64	—	Workaround

Threats

Impact Moderate

CVE-2025-47907

A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.

7.0 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected products

Fixed 6 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64	—	Vendor Fix fix
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64	—	Vendor Fix fix

Known not affected 4 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64		—
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64		—

Threats

Impact Moderate

CVE-2026-48702

A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK) files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be triggered via unauthenticated API endpoints.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64		—	Vendor Fix fix Workaround

Known not affected 9 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64	—	Workaround

Threats

Impact Important

CVE-2026-59869

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64		—	Vendor Fix fix Workaround

Known not affected 9 products

Product	Version	Remediation
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64	—	Workaround
Unresolved product id: Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64	—	Workaround

Threats

Impact Important

References

43 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:59439	self
https://access.redhat.com/documentation/en-us/red…	external
https://access.redhat.com/documentation/en-us/red…	external
https://access.redhat.com/security/cve/CVE-2024-9355	external
https://access.redhat.com/security/cve/CVE-2025-47907	external
https://access.redhat.com/security/cve/CVE-2025-7783	external
https://access.redhat.com/security/cve/CVE-2026-48702	external
https://access.redhat.com/security/cve/CVE-2026-59869	external
https://access.redhat.com/security/updates/classi…	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2024-9355	self
https://bugzilla.redhat.com/show_bug.cgi?id=2315719	external
https://www.cve.org/CVERecord?id=CVE-2024-9355	external
https://nvd.nist.gov/vuln/detail/CVE-2024-9355	external
https://github.com/golang-fips/openssl/pull/198	external
https://access.redhat.com/security/cve/CVE-2025-7783	self
https://bugzilla.redhat.com/show_bug.cgi?id=2381959	external
https://www.cve.org/CVERecord?id=CVE-2025-7783	external
https://nvd.nist.gov/vuln/detail/CVE-2025-7783	external
https://github.com/form-data/form-data/commit/3d1…	external
https://github.com/form-data/form-data/security/a…	external
https://access.redhat.com/security/cve/CVE-2025-47907	self
https://bugzilla.redhat.com/show_bug.cgi?id=2387083	external
https://www.cve.org/CVERecord?id=CVE-2025-47907	external
https://nvd.nist.gov/vuln/detail/CVE-2025-47907	external
https://go.dev/cl/693735	external
https://go.dev/issue/74831	external
https://groups.google.com/g/golang-announce/c/x5M…	external
https://pkg.go.dev/vuln/GO-2025-3849	external
https://access.redhat.com/security/cve/CVE-2026-48702	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499685	external
https://www.cve.org/CVERecord?id=CVE-2026-48702	external
https://nvd.nist.gov/vuln/detail/CVE-2026-48702	external
https://github.com/sigstore/rekor/security/adviso…	external
https://access.redhat.com/security/cve/CVE-2026-59869	self
https://bugzilla.redhat.com/show_bug.cgi?id=2498122	external
https://www.cve.org/CVERecord?id=CVE-2026-59869	external
https://nvd.nist.gov/vuln/detail/CVE-2026-59869	external
https://github.com/nodeca/js-yaml/commit/24f13e79…	external
https://github.com/nodeca/js-yaml/commit/59423c6f…	external
https://github.com/nodeca/js-yaml/releases/tag/3.15.0	external
https://github.com/nodeca/js-yaml/releases/tag/4.3.0	external
https://github.com/nodeca/js-yaml/security/adviso…	external

Acknowledgments

Red Hat David Benoit

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The 1.3.7 release of Red Hat Trusted Artifact Signer OpenShift Operator.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The RHTAS Operator can be used with OpenShift Container Platform 4.16, 4.17, 4.18, 4.19, 4.20 and 4.21",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:59439",
        "url": "https://access.redhat.com/errata/RHSA-2026:59439"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-9355",
        "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-47907",
        "url": "https://access.redhat.com/security/cve/CVE-2025-47907"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-7783",
        "url": "https://access.redhat.com/security/cve/CVE-2025-7783"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48702",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48702"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59869",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_59439.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHTAS 1.3.7 - Red Hat Trusted Artifact Signer Release",
    "tracking": {
      "current_release_date": "2026-08-27T15:29:12+00:00",
      "generator": {
        "date": "2026-08-27T15:29:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:59439",
      "initial_release_date": "2026-08-25T13:53:52+00:00",
      "revision_history": [
        {
          "date": "2026-08-25T13:53:52+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-25T13:54:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-27T15:29:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Trusted Artifact Signer 1.3",
                "product": {
                  "name": "Red Hat Trusted Artifact Signer 1.3",
                  "product_id": "Red Hat Trusted Artifact Signer 1.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Trusted Artifact Signer"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-backfill-redis-rhel9@sha256%3Ae5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-backfill-redis-rhel9\u0026tag=1787305397"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
                  "product_id": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/certificate-transparency-rhel9@sha256%3A3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/certificate-transparency-rhel9\u0026tag=1787305564"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-database-rhel9@sha256%3Ab1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-database-rhel9\u0026tag=1787305441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
                  "product_id": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/fulcio-rhel9@sha256%3Ad8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/fulcio-rhel9\u0026tag=1787305413"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-logserver-rhel9@sha256%3A000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-logserver-rhel9\u0026tag=1787305441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-logsigner-rhel9@sha256%3Aa648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-logsigner-rhel9\u0026tag=1787305441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64",
                  "product_id": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/trillian-redis-rhel9@sha256%3Ada71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/trillian-redis-rhel9\u0026tag=1787305441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-search-ui-rhel9@sha256%3A6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-search-ui-rhel9\u0026tag=1787305549"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-server-rhel9@sha256%3A18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/rekor-server-rhel9\u0026tag=1787305397"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
                  "product_id": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/timestamp-authority-rhel9@sha256%3A825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471?arch=amd64\u0026repository_url=registry.redhat.io/rhtas/timestamp-authority-rhel9\u0026tag=1787305474"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64 as a component of Red Hat Trusted Artifact Signer 1.3",
          "product_id": "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "David Benoit"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2024-9355",
      "cwe": {
        "id": "CWE-457",
        "name": "Use of Uninitialized Variable"
      },
      "discovery_date": "2024-09-30T17:51:17.811000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2315719"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang-fips: Golang FIPS zeroed buffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is specific to the Go language and only affects the test code in cri-o and conmon, not the production code. Since both projects use Go exclusively for testing purposes, this issue does not impact their production environment. Therefore, cri-o and conmon are not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2315719",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-9355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9355"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang-fips/openssl/pull/198",
          "url": "https://github.com/golang-fips/openssl/pull/198"
        }
      ],
      "release_date": "2024-09-30T20:53:42.833000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:53:52+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59439"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang-fips: Golang FIPS zeroed buffer"
    },
    {
      "cve": "CVE-2025-7783",
      "cwe": {
        "id": "CWE-330",
        "name": "Use of Insufficiently Random Values"
      },
      "discovery_date": "2025-07-18T17:00:43.396637+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2381959"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data.\n\nThis presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "form-data: Unsafe random function in form-data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw does not affect host systems. The impact of this vulnerability is limited to specific applications which integrate the `form-data` library. As a result the impact of this CVE is limited on RedHat systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-7783"
        },
        {
          "category": "external",
          "summary": "RHBZ#2381959",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2381959"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-7783",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-7783"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-7783",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7783"
        },
        {
          "category": "external",
          "summary": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0",
          "url": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0"
        },
        {
          "category": "external",
          "summary": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4",
          "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
        }
      ],
      "release_date": "2025-07-18T16:34:44.889000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:53:52+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59439"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "form-data: Unsafe random function in form-data"
    },
    {
      "cve": "CVE-2025-47907",
      "cwe": {
        "id": "CWE-362",
        "name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
      },
      "discovery_date": "2025-08-07T16:01:06.247481+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2387083"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leading to inconsistent data being returned to the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "database/sql: Postgres Scan Race Condition",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability marked as Moderate severity issues rather than Important. The os/exec LookPath flaw requires a misconfigured PATH to be exploitable, and the database/sql race condition primarily impacts applications that cancel queries while running multiple queries concurrently. Both can cause unexpected behavior, but the exploitation scope is limited and unlikely to result in direct compromise in most typical deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "RHBZ#2387083",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2387083"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-47907",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47907"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/693735",
          "url": "https://go.dev/cl/693735"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/74831",
          "url": "https://go.dev/issue/74831"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM",
          "url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2025-3849",
          "url": "https://pkg.go.dev/vuln/GO-2025-3849"
        }
      ],
      "release_date": "2025-08-07T15:25:30.704000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:53:52+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59439"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "database/sql: Postgres Scan Race Condition"
    },
    {
      "cve": "CVE-2026-48702",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-25T21:33:36+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499685"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Rekor. The `Package.Unmarshal()` function, which processes Alpine Package Keep (APK) files, decompresses gzip streams without limiting the total decompressed size. A remote attacker can exploit this by crafting a malicious APK file with a high compression ratio, causing the server to consume excessive memory. This leads to a Denial of Service (DoS) through an out-of-memory (OOM) error, and can be triggered via unauthenticated API endpoints.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in Rekor, a transparency log for supply chain security. The Alpine APK parsing logic decompresses gzip members without bounding total decompressed size, allowing a decompression bomb to cause out-of-memory conditions via unauthenticated API endpoints. This vulnerability is server-side only, affecting the Rekor server\u0027s APK entry processing. Products that import github.com/sigstore/rekor as a Go client library are not affected, as the vulnerable code path (Package.Unmarshal in pkg/types/alpine/apk.go) is only reachable through the Rekor server\u0027s HTTP API handlers.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48702"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499685",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499685"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48702",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48702"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48702",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48702"
        },
        {
          "category": "external",
          "summary": "https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m",
          "url": "https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m"
        }
      ],
      "release_date": "2026-06-25T21:33:36+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:53:52+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59439"
        },
        {
          "category": "workaround",
          "details": "There is no effective workaround. Setting max_request_body_size reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting max_apk_metadata_size has no effect on this vulnerability since the check is applied after decompression.\n\nUpgrade to Rekor 1.5.2 or later.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/sigstore/rekor: Rekor: Denial of Service due to unbounded gzip decompression in Alpine APK parsing"
    },
    {
      "cve": "CVE-2026-59869",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-07-08T16:01:38.408322+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498122"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64"
        ],
        "known_not_affected": [
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
          "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498122",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498122"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59869"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        }
      ],
      "release_date": "2026-07-08T15:15:54.675000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-25T13:53:52+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev\n\nPlatform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain.\n\nFor details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:59439"
        },
        {
          "category": "workaround",
          "details": "To reduce exposure, restrict the processing of untrusted YAML documents by applications that rely on `js-yaml`. Implement robust input validation and sanitization for all YAML data originating from external or untrusted sources. Consider limiting network access to services that parse YAML content to trusted networks or clients through appropriate firewall configurations.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/certificate-transparency-rhel9@sha256:3dfd34b38cebe837a89e9f9f3baf306865a2db1c058ae3ddc6db83562361ae64_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/fulcio-rhel9@sha256:d8b9ed0fe81cbb70afaafb65d064256397fa2c5d8f0053e9ad021a59a42a9893_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-backfill-redis-rhel9@sha256:e5f2498eba9553f7a61535cd7ece720144531b22db11ee125d5a5221f15cc6c8_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:6bd53115c9f934cf0ce686b6954fc1622d80fd07ff78ab97f1f5a3c927d37faf_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/rekor-server-rhel9@sha256:18dce4bc83ee2cb8f32fc4262d303841047bdb6c538cc87fc43d7e8e2d6ef39b_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/timestamp-authority-rhel9@sha256:825e7da7dfb0be5d8c04b18d80848f0f84a334a7422beaf779f3d3477495e471_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-database-rhel9@sha256:b1364b88ef4b92c33db31764daf6045647ff03fec43331e7a444a10f1e2f8632_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logserver-rhel9@sha256:000941edac43313345e8187b4770923b18f950552d0be44a2466b951c9255b0d_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-logsigner-rhel9@sha256:a648133e0aeec88ebc74c9df5067c9f4ae7163b4602bc73f22151eff79f5684c_amd64",
            "Red Hat Trusted Artifact Signer 1.3:registry.redhat.io/rhtas/trillian-redis-rhel9@sha256:da71f8d4efda741cabc4db94b690951910b358a4d5a51845ca8531eea802a3fa_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "js-yaml: js-yaml: Denial of Service via crafted YAML documents"
    }
  ]
}

CVE-2024-9355 (GCVE-0-2024-9355)

Vulnerability from cvelistv5 – Published: 2024-10-01 18:17 – Updated: 2026-08-25 14:54

Title

Golang-fips: golang fips zeroed buffer

Summary

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-01 18:35 UTC

CWE

CWE-457 - Use of Uninitialized Variable

Assigner

redhat redhat root

References

17 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:10133	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:7502	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:7550	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:8327	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:8678	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:8847	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:9551	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:2416	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7118	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7256	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:7624	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:55525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59439	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-9355	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2315719	issue-trackingx_refsource_REDHAT
https://github.com/golang-fips/openssl/pull/198

Impacted products

39 products

Vendor	Product	Version

Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:0.10-2.el7_9 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020241001112709.a3795dee , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:9.2.10-20.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:5.1.1-9.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.21.13-4.el9_4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:9.2.10-19.el9_4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:132-1.el9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:3.6.1-1.el9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:0.17.0-1.el9_2.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	Unaffected: 0:5.1.1-4.el9_4 , < * (rpm) cpe:/a:redhat:rhel_eus:9.4::appstream
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:0.23.0-1.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6::appstream
Red Hat	Satellite Client 6 for RHEL 10	Unaffected: 0:0.3.1-1.el10sat , < * (rpm) cpe:/a:redhat:rhel_satellite_client:6::el10 cpe:/a:redhat:rhel_satellite_client:6::el8 cpe:/a:redhat:rhel_satellite_client:6::el9
Red Hat	Satellite Client 6 for RHEL 8	Unaffected: 0:0.3.1-1.el8sat , < * (rpm) cpe:/a:redhat:rhel_satellite_client:6::el10 cpe:/a:redhat:rhel_satellite_client:6::el8 cpe:/a:redhat:rhel_satellite_client:6::el9
Red Hat	Satellite Client 6 for RHEL 9	Unaffected: 0:0.3.1-1.el9sat , < * (rpm) cpe:/a:redhat:rhel_satellite_client:6::el10 cpe:/a:redhat:rhel_satellite_client:6::el8 cpe:/a:redhat:rhel_satellite_client:6::el9
Red Hat	Streams for Apache Kafka 2.9.0	cpe:/a:redhat:amq_streams:2
Red Hat	Red Hat Trusted Artifact Signer 1.3	Unaffected: 1787305413 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.3::el9
Red Hat	NBDE Tang Server	cpe:/a:redhat:network_bound_disk_encryption_tang:1
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	Red Hat Ansible Automation Platform 1.2	cpe:/a:redhat:ansible_automation_platform
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Container Storage 4	cpe:/a:redhat:openshift_container_storage:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift Dev Spaces	cpe:/a:redhat:openshift_devspaces:3
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat OpenShift on AWS	cpe:/a:redhat:openshift_service_on_aws:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Service Interconnect 1	cpe:/a:redhat:service_interconnect:1
Red Hat	Red Hat Storage 3	cpe:/a:redhat:storage:3

Date Public

2024-09-30 20:53

Credits

This issue was discovered by David Benoit (Red Hat).

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9355",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-01T18:35:51.670441Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-01T18:37:53.436Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/golang-fips/openssl",
          "defaultStatus": "affected",
          "packageName": "github.com/golang-fips/openssl"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:7"
          ],
          "defaultStatus": "affected",
          "packageName": "rhc-worker-script",
          "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.10-2.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "go-toolset:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020241001112709.a3795dee",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "grafana",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.2.10-20.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "grafana-pcp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.1.1-9.el8_10",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "golang",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.21.13-4.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "grafana",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:9.2.10-19.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:132-1.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "git-lfs",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:3.6.1-1.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "butane",
          "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.17.0-1.el9_2.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "grafana-pcp",
          "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:5.1.1-4.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "butane",
          "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.23.0-1.el9_6.1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_satellite_client:6::el10",
            "cpe:/a:redhat:rhel_satellite_client:6::el8",
            "cpe:/a:redhat:rhel_satellite_client:6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman_ygg_worker",
          "product": "Satellite Client 6 for RHEL 10",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.3.1-1.el10sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_satellite_client:6::el10",
            "cpe:/a:redhat:rhel_satellite_client:6::el8",
            "cpe:/a:redhat:rhel_satellite_client:6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman_ygg_worker",
          "product": "Satellite Client 6 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.3.1-1.el8sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_satellite_client:6::el10",
            "cpe:/a:redhat:rhel_satellite_client:6::el8",
            "cpe:/a:redhat:rhel_satellite_client:6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "foreman_ygg_worker",
          "product": "Satellite Client 6 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:0.3.1-1.el9sat",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:amq_streams:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-github-danielqsj-kafka_exporter",
          "product": "Streams for Apache Kafka 2.9.0",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhtas/fulcio-rhel9",
          "product": "Red Hat Trusted Artifact Signer 1.3",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1787305413",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:network_bound_disk_encryption_tang:1"
          ],
          "defaultStatus": "affected",
          "packageName": "tang-operator-bundle-container",
          "product": "NBDE Tang Server",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "helm",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ocp_tools"
          ],
          "defaultStatus": "affected",
          "packageName": "odo",
          "product": "OpenShift Developer Tools and Services",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_pipelines:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-pipelines-client",
          "product": "OpenShift Pipelines",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:serverless:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-serverless-clients",
          "product": "OpenShift Serverless",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform"
          ],
          "defaultStatus": "affected",
          "packageName": "helm",
          "product": "Red Hat Ansible Automation Platform 1.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-clients",
          "product": "Red Hat Ansible Automation Platform 1.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "automation-gateway-proxy",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "receptor",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "butane",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "containers-common",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "delve",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "git-lfs",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-github-openprinting-ipp-usb",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "grafana",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "grafana-pcp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "gvisor-tap-vsock",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ignition",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rsyslog",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "toolbox",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "yggdrasil",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "yggdrasil-worker-package-manager",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "host-metering",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/buildah",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "container-tools:rhel8/conmon",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/containernetworking-plugins",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/podman",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/runc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/skopeo",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/toolbox",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "git-lfs",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "osbuild-composer",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "rhc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rsyslog",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "weldr-client",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "butane",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "containernetworking-plugins",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "grafana-pcp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "gvisor-tap-vsock",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "ignition",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "opentelemetry-collector",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rsyslog",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "runc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "unaffected",
          "packageName": "toolbox",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "weldr-client",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "butane",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "conmon-rs",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "containernetworking-plugins",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "cri-o",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "cri-tools",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-github-prometheus-promu",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "ignition",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "lifecycle-agent-operator-bundle-container",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "microshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/bare-metal-event-relay-operator-bundle",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/numaresources-operator-bundle",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-aws-efs-csi-driver-container-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-gcp-filestore-csi-driver-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ose-secrets-store-csi-driver-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-sriov-network-metrics-exporter-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-sriov-rdma-cni-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/ose-vertical-pod-autoscaler-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift4/sriov-network-metrics-exporter-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/topology-aware-lifecycle-manager-operator-bundle",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift-clients",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ose-aws-ecr-image-credential-provider",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ose-azure-acr-image-credential-provider",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ose-gcp-gcr-image-credential-provider",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "runc",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "skopeo",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_container_storage:4"
          ],
          "defaultStatus": "affected",
          "packageName": "mcg",
          "product": "Red Hat Openshift Container Storage 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_data_foundation:4"
          ],
          "defaultStatus": "unaffected",
          "packageName": "mcg",
          "product": "Red Hat Openshift Data Foundation 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "devspaces/machineexec-rhel8",
          "product": "Red Hat OpenShift Dev Spaces",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/gitops-operator-bundle",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_service_on_aws:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rosa",
          "product": "Red Hat OpenShift on AWS",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "defaultStatus": "affected",
          "packageName": "kubevirt",
          "product": "Red Hat OpenShift Virtualization 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2"
          ],
          "defaultStatus": "affected",
          "packageName": "etcd",
          "product": "Red Hat OpenStack Platform 16.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-github-infrawatch-apputils",
          "product": "Red Hat OpenStack Platform 16.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-qpid-apache",
          "product": "Red Hat OpenStack Platform 16.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:16.2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "qpid-proton",
          "product": "Red Hat OpenStack Platform 16.2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:17.1"
          ],
          "defaultStatus": "affected",
          "packageName": "etcd",
          "product": "Red Hat OpenStack Platform 17.1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:17.1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-github-infrawatch-apputils",
          "product": "Red Hat OpenStack Platform 17.1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:17.1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "golang-qpid-apache",
          "product": "Red Hat OpenStack Platform 17.1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openstack:17.1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "qpid-proton",
          "product": "Red Hat OpenStack Platform 17.1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "qpid-proton",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "satellite-capsule:el8/qpid-proton",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite:el8/qpid-proton",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "satellite:el8/yggdrasil-worker-forwarder",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "affected",
          "packageName": "yggdrasil-worker-forwarder",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1"
          ],
          "defaultStatus": "affected",
          "packageName": "qpid-proton",
          "product": "Red Hat Service Interconnect 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1"
          ],
          "defaultStatus": "unaffected",
          "packageName": "skupper-cli",
          "product": "Red Hat Service Interconnect 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_interconnect:1"
          ],
          "defaultStatus": "affected",
          "packageName": "skupper-router",
          "product": "Red Hat Service Interconnect 1",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:storage:3"
          ],
          "defaultStatus": "affected",
          "packageName": "heketi",
          "product": "Red Hat Storage 3",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by David Benoit (Red Hat)."
        }
      ],
      "datePublic": "2024-09-30T20:53:42.833Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.\u00a0 It is also possible to force a derived key to be all zeros instead of an unpredictable value.\u00a0 This may have follow-on implications for the Go TLS stack."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T14:54:46.161Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:10133",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10133"
        },
        {
          "name": "RHSA-2024:7502",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7502"
        },
        {
          "name": "RHSA-2024:7550",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:7550"
        },
        {
          "name": "RHSA-2024:8327",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8327"
        },
        {
          "name": "RHSA-2024:8678",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8678"
        },
        {
          "name": "RHSA-2024:8847",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:8847"
        },
        {
          "name": "RHSA-2024:9551",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:9551"
        },
        {
          "name": "RHSA-2025:2416",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:2416"
        },
        {
          "name": "RHSA-2025:7118",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7118"
        },
        {
          "name": "RHSA-2025:7256",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7256"
        },
        {
          "name": "RHSA-2025:7624",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:7624"
        },
        {
          "name": "RHSA-2026:55520",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55520"
        },
        {
          "name": "RHSA-2026:55525",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:55525"
        },
        {
          "name": "RHSA-2026:59439",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2026:59439"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-9355"
        },
        {
          "name": "RHBZ#2315719",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2315719"
        },
        {
          "url": "https://github.com/golang-fips/openssl/pull/198"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-09-30T17:51:17.811Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-09-30T20:53:42.833Z",
          "value": "Made public."
        }
      ],
      "title": "Golang-fips: golang fips zeroed buffer",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-457: Use of Uninitialized Variable"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-9355",
    "datePublished": "2024-10-01T18:17:29.420Z",
    "dateReserved": "2024-09-30T17:07:30.833Z",
    "dateUpdated": "2026-08-25T14:54:46.161Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-47907 (GCVE-0-2025-47907)

Vulnerability from cvelistv5 – Published: 2025-08-07 15:25 – Updated: 2025-11-04 21:10

Title

Incorrect results returned from Rows.Scan in database/sql

Summary

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.

Severity

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-08-07 15:45 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/cl/693735
https://go.dev/issue/74831
https://groups.google.com/g/golang-announce/c/x5M…
https://pkg.go.dev/vuln/GO-2025-3849
http://www.openwall.com/lists/oss-security/2025/08/06/1

Impacted products

1 product

Vendor	Product	Version
Go standard library	database/sql	Affected: 0 , < 1.23.12 (semver) Affected: 1.24.0 , < 1.24.6 (semver)

Credits

Spike Curtis from Coder

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-47907",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-07T15:45:26.297503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-07T15:48:03.634Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:10:56.083Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/08/06/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "database/sql",
          "product": "database/sql",
          "programRoutines": [
            {
              "name": "Rows.Scan"
            },
            {
              "name": "Row.Scan"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.23.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.24.6",
              "status": "affected",
              "version": "1.24.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Spike Curtis from Coder"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-07T15:25:30.704Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/693735"
        },
        {
          "url": "https://go.dev/issue/74831"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/x5MKroML2yM"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2025-3849"
        }
      ],
      "title": "Incorrect results returned from Rows.Scan in database/sql"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2025-47907",
    "datePublished": "2025-08-07T15:25:30.704Z",
    "dateReserved": "2025-05-13T23:31:29.597Z",
    "dateUpdated": "2025-11-04T21:10:56.083Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-7783 (GCVE-0-2025-7783)

Vulnerability from cvelistv5 – Published: 2025-07-18 16:34 – Updated: 2025-11-03 20:07

Title

Usage of unsafe random function in form-data for choosing boundary

Summary

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-22 14:54 UTC

CWE

CWE-330 - Use of Insufficiently Random Values

Assigner

harborist redhat root

References

3 references

URL	Tags
https://github.com/form-data/form-data/security/a…	third-party-advisory
https://github.com/form-data/form-data/commit/3d1…	patch
https://lists.debian.org/debian-lts-announce/2025…

Impacted products

1 product

Vendor	Product	Version
		Affected: < 2.5.4 (semver) Affected: 3.0.0 - 3.0.3 (semver) Affected: 4.0.0 - 4.0.3 (semver)

Credits

https://github.com/benweissmann https://github.com/benweissmann https://github.com/ljharb

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-7783",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-22T14:54:27.721309Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-22T14:54:31.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:07:41.307Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00023.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://npmjs.com/form-data",
          "defaultStatus": "unaffected",
          "packageName": "form-data",
          "programFiles": [
            "lib/form_data.js"
          ],
          "repo": "https://github.com/form-data/form-data",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.5.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.0.0 - 3.0.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.0.0 - 4.0.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "https://github.com/benweissmann"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "https://github.com/benweissmann"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "https://github.com/ljharb"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003elib/form_data.Js\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects form-data: \u0026lt; 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.\u003c/p\u003e"
            }
          ],
          "value": "Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.\n\nThis issue affects form-data: \u003c 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-460",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-460 HTTP Parameter Pollution (HPP)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-330",
              "description": "CWE-330 Use of Insufficiently Random Values",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-18T16:34:44.889Z",
        "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "shortName": "harborist"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/form-data/form-data/security/advisories/GHSA-fjxv-7rqg-78g4"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/form-data/form-data/commit/3d1723080e6577a66f17f163ecd345a21d8d0fd0"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Usage of unsafe random function in form-data for choosing boundary",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
    "assignerShortName": "harborist",
    "cveId": "CVE-2025-7783",
    "datePublished": "2025-07-18T16:34:44.889Z",
    "dateReserved": "2025-07-18T04:34:56.939Z",
    "dateUpdated": "2025-11-03T20:07:41.307Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48702 (GCVE-0-2026-48702)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:14 – Updated: 2026-08-13 15:16

Title

Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic

Summary

Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 15:12 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/sigstore/rekor/security/adviso…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
sigstore	rekor	Affected: >= 0.3.0, < 1.5.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48702",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T15:12:38.632066Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:16:26.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rekor",
          "vendor": "sigstore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.3.0, \u003c 1.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros \u2192 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server\u0027s recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` \u2192 `fetchExternalEntities()` \u2192 `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T13:14:19.324Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sigstore/rekor/security/advisories/GHSA-47q9-m4ww-924m"
        }
      ],
      "source": {
        "advisory": "GHSA-47q9-m4ww-924m",
        "discovery": "UNKNOWN"
      },
      "title": "Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48702",
    "datePublished": "2026-08-13T13:14:19.324Z",
    "dateReserved": "2026-05-22T18:47:27.754Z",
    "dateUpdated": "2026-08-13T15:16:26.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-59869 (GCVE-0-2026-59869)

Vulnerability from cvelistv5 – Published: 2026-07-08 15:15 – Updated: 2026-07-09 15:14

Title

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Summary

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-09 15:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/nodeca/js-yaml/security/adviso…	x_refsource_CONFIRM
https://github.com/nodeca/js-yaml/commit/24f13e79…	x_refsource_MISC
https://github.com/nodeca/js-yaml/commit/59423c6f…	x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/3.15.0	x_refsource_MISC
https://github.com/nodeca/js-yaml/releases/tag/4.3.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nodeca	js-yaml	Affected: >= 3.0.0, < 3.15.0 Affected: >= 4.0.0, < 4.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59869",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T15:14:16.302841Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T15:14:29.753Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "js-yaml",
          "vendor": "nodeca",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.15.0"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.3.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T15:15:54.675Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/releases/tag/3.15.0"
        },
        {
          "name": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nodeca/js-yaml/releases/tag/4.3.0"
        }
      ],
      "source": {
        "advisory": "GHSA-52cp-r559-cp3m",
        "discovery": "UNKNOWN"
      },
      "title": "js-yaml: YAML merge-key chains can force quadratic CPU consumption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59869",
    "datePublished": "2026-07-08T15:15:54.675Z",
    "dateReserved": "2026-07-07T15:41:53.607Z",
    "dateUpdated": "2026-07-09T15:14:29.753Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:59439

CVE-2024-9355 (GCVE-0-2024-9355)

CVE-2025-47907 (GCVE-0-2025-47907)

CVE-2025-7783 (GCVE-0-2025-7783)

CVE-2026-48702 (GCVE-0-2026-48702)

CVE-2026-59869 (GCVE-0-2026-59869)

Tags

Sightings

Nomenclature