rhsa-2025:8385
Vulnerability from csaf_redhat
Published
2025-06-02 14:07
Modified
2025-08-14 15:34
Summary
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
Notes
Topic
A Subscription Management tool for finding and reporting Red Hat product usage
Details
Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A Subscription Management tool for finding and reporting Red Hat product usage",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their operating systems, and relevant configuration data stored within them. Discovery also identifies and reports more detailed facts for some versions of key Red Hat packages and products that it finds in the network.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:8385",
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-4752",
"url": "https://access.redhat.com/security/cve/CVE-2023-4752"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12087",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12088",
"url": "https://access.redhat.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12133",
"url": "https://access.redhat.com/security/cve/CVE-2024-12133"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12243",
"url": "https://access.redhat.com/security/cve/CVE-2024-12243"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-12747",
"url": "https://access.redhat.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-35195",
"url": "https://access.redhat.com/security/cve/CVE-2024-35195"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-52005",
"url": "https://access.redhat.com/security/cve/CVE-2024-52005"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-8176",
"url": "https://access.redhat.com/security/cve/CVE-2024-8176"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-0938",
"url": "https://access.redhat.com/security/cve/CVE-2025-0938"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-24528",
"url": "https://access.redhat.com/security/cve/CVE-2025-24528"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-26465",
"url": "https://access.redhat.com/security/cve/CVE-2025-26465"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery",
"url": "https://docs.redhat.com/en/documentation/subscription_central/1-latest/#Discovery"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8385.json"
}
],
"title": "Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage",
"tracking": {
"current_release_date": "2025-08-14T15:34:16+00:00",
"generator": {
"date": "2025-08-14T15:34:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.6"
}
},
"id": "RHSA-2025:8385",
"initial_release_date": "2025-06-02T14:07:46+00:00",
"revision_history": [
{
"date": "2025-06-02T14:07:46+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-06-02T14:07:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-08-14T15:34:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Discovery 1.14",
"product": {
"name": "Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:discovery:1.14::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Af33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63?arch=amd64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.3-1748529279"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3A492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644?arch=amd64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.2-1748467619"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"product_id": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256%3Aad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c?arch=arm64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.3-1748529279"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"product": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"product_id": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256%3Ac960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e?arch=arm64\u0026repository_url=registry.redhat.io/discovery\u0026tag=1.14.2-1748467619"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64 as a component of Red Hat Discovery 1.14",
"product_id": "Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
},
"product_reference": "registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64",
"relates_to_product_reference": "Red Hat Discovery 1.14"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-4752",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2023-09-04T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2237311"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, where it is vulnerable to a use-after-free in the ins_compl_get_exp function. This flaw allows a specially crafted file to crash software, use unexpected values, or possibly execute code when opened in Vim.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: use-after-free in function ins_compl_get_exp in vim/vim",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this issue as having a Low security impact, because the \"victim\" has to run an untrusted file IN SCRIPT MODE. Someone who is running untrusted files in script mode is equivalent to someone just taking a random python script and running it.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-4752"
},
{
"category": "external",
"summary": "RHBZ#2237311",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237311"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-4752",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4752"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-4752",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4752"
},
{
"category": "external",
"summary": "https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757",
"url": "https://huntr.dev/bounties/85f62dd7-ed84-4fa2-b265-8a369a318757"
}
],
"release_date": "2023-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "vim: use-after-free in function ins_compl_get_exp in vim/vim"
},
{
"acknowledgments": [
{
"names": [
"Jann Horn"
],
"organization": "Google Project Zero"
},
{
"names": [
"Tomas Korbar",
"Sandipan Roy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
},
{
"names": [
"Sebastian Pipping"
],
"organization": "libexpat"
}
],
"cve": "CVE-2024-8176",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310137"
}
],
"notes": [
{
"category": "description",
"text": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "All supported Red Hat offerings are built with the compilation flag (-fstack-clash-protection) which reduces the impact to Moderate. This build configuration blocks the possibility of an attacker gaining arbitrary code execution even if a stack-clash vulnerability, like this one, could be exploited.\n\nThis vulnerability is rated Moderate because Red Hat builds use the `-fstack-clash-protection` compiler flag, which mitigates the risk of arbitrary code execution from stack overflows. While the flaw allows a crash via uncontrolled recursion in XML parsing, the hardened stack layout prevents reliable memory corruption, limiting the impact to a Denial of Service (DoS) scenario.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-674: Uncontrolled Recursion vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nInput validation controls ensure that inputs triggering recursion are validated to stay within safe limits, which reduces the risk of infinite or excessive recursion. The implementation of least functionality on the platform further restricts potential impacts of recursions by disabling unnecessary recursive functions or features, thus reducing the available pathways for a would-be attacker. The inclusion of developer testing and evaluation ensures that recursive functions are tested and that safeguards like error handling are in place. In the case of successful exploitation, detection and containment controls are in place to limit impacts by alerting on anomalous system behavior in real time, while process isolation can limit impacts to a single process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-8176"
},
{
"category": "external",
"summary": "RHBZ#2310137",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310137"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-8176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8176"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8176",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8176"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/issues/893",
"url": "https://github.com/libexpat/libexpat/issues/893"
}
],
"release_date": "2025-03-13T13:51:54.957000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat"
},
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Pedro Gallegos",
"Jasiel Spelman"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12087",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:23:24.139000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330672"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client\u0027s intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Path traversal vulnerability in rsync",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw to have moderate severity as it depends on specific configurations for the attack to succeed, symbolic link syncing must be enabled (explicitly by providing the `--links` option or implicitly such as with `--archive`) and the client must connect to a malicious or compromised server.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-35: Path Traversal: \u0027.../...//\u0027 vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe principle of least privilege is enforced through non-root containers, security context constraints, and pod-level security policies, which limit the actions a process can perform and reduce the potential impact of a successful exploit or misconfiguration. The platform enforces process isolation, ensuring workloads run with minimal privileges and are securely separated to limit the impact of path traversal attempts. Additionally, static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12087"
},
{
"category": "external",
"summary": "RHBZ#2330672",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330672"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12087",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12087"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12087"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Path traversal vulnerability in rsync"
},
{
"acknowledgments": [
{
"names": [
"Simon Scannell",
"Jasiel Spelman",
"Pedro Gallegos"
],
"organization": "Google"
}
],
"cve": "CVE-2024-12088",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2024-12-05T21:55:22.700000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: --safe-links option bypass leads to path traversal",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-35: Path Traversal: \u0027.../...//\u0027 vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe principle of least privilege is enforced through non-root containers, security context constraints, and pod-level security policies, which limit the actions a process can perform and reduce the potential impact of a successful exploit or misconfiguration. The platform enforces process isolation, ensuring workloads run with minimal privileges and are securely separated to limit the impact of path traversal attempts. Additionally, static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12088"
},
{
"category": "external",
"summary": "RHBZ#2330676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330676"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12088",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12088"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12088"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: --safe-links option bypass leads to path traversal"
},
{
"acknowledgments": [
{
"names": [
"Bing Shi"
]
}
],
"cve": "CVE-2024-12133",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-02-10T08:14:05.460000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2344611"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12133"
},
{
"category": "external",
"summary": "RHBZ#2344611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344611"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12133",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12133"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12133"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/issues/52",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
}
],
"release_date": "2025-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS"
},
{
"acknowledgments": [
{
"names": [
"Bing Shi"
]
}
],
"cve": "CVE-2024-12243",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-02-10T08:33:56.422000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2344615"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12243"
},
{
"category": "external",
"summary": "RHBZ#2344615",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344615"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12243",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12243"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/issues/52",
"url": "https://gitlab.com/gnutls/libtasn1/-/issues/52"
}
],
"release_date": "2025-02-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS"
},
{
"acknowledgments": [
{
"names": [
"Aleksei Gorban \"loqpa\""
]
}
],
"cve": "CVE-2024-12747",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"discovery_date": "2024-12-18T07:12:52.493000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2332968"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rsync. This vulnerability arises from a race condition during rsync\u0027s handling of symbolic links. Rsync\u0027s default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass the default behavior and traverse symbolic links. Depending on the privileges of the rsync process, an attacker could leak sensitive information, potentially leading to privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsync: Race Condition in rsync Handling Symbolic Links",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. The environment leverages malicious code protections such as IPS/IDS and antimalware solutions that detect and respond to indicators in real time, limiting the impact of exploitation attempts. Static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks. In the case of successful exploitation, detection and containment controls are in place to limit impacts by alerting on anomalous system behavior in real time, while process isolation and automated orchestration via Kubernetes minimize the likelihood of concurrent execution scenarios that would trigger the race condition and help contain the impact to a single process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-12747"
},
{
"category": "external",
"summary": "RHBZ#2332968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-12747",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12747"
},
{
"category": "external",
"summary": "https://kb.cert.org/vuls/id/952657",
"url": "https://kb.cert.org/vuls/id/952657"
}
],
"release_date": "2025-01-14T15:06:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsync: Race Condition in rsync Handling Symbolic Links"
},
{
"cve": "CVE-2024-35195",
"cwe": {
"id": "CWE-670",
"name": "Always-Incorrect Control Flow Implementation"
},
"discovery_date": "2024-05-21T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2282114"
}
],
"notes": [
{
"category": "description",
"text": "An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "requests: subsequent requests to the same host ignore cert verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-670: Always-Incorrect Control Flow Implementation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform\u0027s orchestration features, such as liveness and readiness probes, automated pod restarts, and health monitoring, help to quickly detect and recover from service-level failures resulting from incorrect control flows. Static code analysis and peer code review techniques are used to execute robust input validation and error-handling mechanisms to ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks. Additionally, process isolation ensures that component issues are contained within the originating process, preventing them from affecting other processes or the system as a whole.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-35195"
},
{
"category": "external",
"summary": "RHBZ#2282114",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2282114"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-35195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-35195"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-35195",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35195"
},
{
"category": "external",
"summary": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56",
"url": "https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"
}
],
"release_date": "2024-05-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "requests: subsequent requests to the same host ignore cert verification"
},
{
"cve": "CVE-2024-52005",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"discovery_date": "2025-01-15T18:01:05.807300+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2338289"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Git. When cloning, fetching, or pushing from a server, informational or error messages are transported from the remote Git process to the client via a sideband channel. These messages are prefixed with \"remote:\" and printed directly to the standard error output. Typically, this standard error output is connected to a terminal that understands ANSI escape sequences, which Git did not protect against. Most modern terminals support control sequences that can be used by a malicious actor to hide and misrepresent information or to mislead the user into executing untrusted scripts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "git: The sideband payload is passed unfiltered to the terminal in git",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is classified as moderate rather than important because it primarily affects informational messages rather than directly compromising repository integrity or executing arbitrary code. The issue arises from Git\u0027s failure to sanitize ANSI escape sequences in messages received over the sideband channel, which could allow a malicious remote repository to manipulate terminal output. However, exploitation requires user interaction, such as manually copying and executing misleading commands. Unlike higher-severity vulnerabilities, this does not provide direct unauthorized access, remote code execution, or privilege escalation, limiting its overall impact. The risk is further mitigated by best practices, such as avoiding recursive clones from untrusted sources.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a (CWE-116: Improper Encoding or Escaping of Output | CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis and peer reviews help ensure input validation and output encoding are properly implemented, reducing the risk of system instability, data exposure, and security issues. Event logs are collected and processed for centralization, correlation, analysis, monitoring, reporting, alerting, and retention, which ensures that unexpected or malicious output behavior is detectable post-deployment. In the event of successful exploitation, process isolation contains the impact to the affected workload through containerization, pod-level security policies, and network segmentation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-52005"
},
{
"category": "external",
"summary": "RHBZ#2338289",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338289"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-52005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52005"
},
{
"category": "external",
"summary": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329",
"url": "https://github.com/git/git/security/advisories/GHSA-7jjc-gg6m-3329"
},
{
"category": "external",
"summary": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net",
"url": "https://lore.kernel.org/git/1M9FnZ-1taoNo1wwh-00ESSd@mail.gmx.net"
}
],
"release_date": "2025-01-15T17:35:02.379000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "git: The sideband payload is passed unfiltered to the terminal in git"
},
{
"cve": "CVE-2025-0938",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2025-01-31T18:00:46.128427+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2343237"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain names that included square brackets, which isn\u0027t valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: cpython: URL parser allowed square brackets in domain names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-20: Improper Input Validation vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nRed Hat enforces the principle of least functionality, ensuring that only essential features, services, and ports are enabled. This minimizes the number of components that could be affected by input validation vulnerabilities. Security testing and evaluation standards are implemented within the environment to rigorously test input validation mechanisms during the development lifecycle, while static code analysis identifies potential input validation vulnerabilities by default. Process isolation ensures that processes handling potentially malicious or unvalidated inputs run in isolated environments by separating execution domains for each process. Malicious code protections, such as IPS/IDS and antimalware solutions, help detect and mitigate malicious payloads stemming from input validation vulnerabilities. Finally, robust input validation and error-handling mechanisms ensure all user inputs are thoroughly validated, preventing improperly validated inputs from causing system instability, exposing sensitive data, or escalating risks further.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-0938"
},
{
"category": "external",
"summary": "RHBZ#2343237",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-0938",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0938"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-0938",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0938"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/105704",
"url": "https://github.com/python/cpython/issues/105704"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/129418",
"url": "https://github.com/python/cpython/pull/129418"
}
],
"release_date": "2025-01-31T17:51:35.898000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: cpython: URL parser allowed square brackets in domain names"
},
{
"cve": "CVE-2025-24528",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2025-01-29T13:47:59.362000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2342796"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in krb5. With incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file. This issue can trigger a process crash and lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "krb5: overflow when calculating ulog block size",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Within regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-787: Out-of-bounds Write vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform enforces hardening guidelines to apply the most restrictive settings necessary for operational requirements. Baseline configurations and system controls ensure secure software settings, while least functionality reduces the attack surface by disabling unauthorized services and ports. The environment employs IPS/IDS and antimalware solutions to detect and prevent malicious code exploiting out-of-bounds write vulnerabilities, using mechanisms such as file integrity monitoring and patch management. Robust input validation and error handling ensure all user inputs are thoroughly validated, preventing instability, data exposure, or privilege escalation. Finally, the platform uses memory protection mechanisms such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) to strengthen resilience against out-of-bounds write exploits.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-24528"
},
{
"category": "external",
"summary": "RHBZ#2342796",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2342796"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-24528",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-24528"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-24528",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24528"
},
{
"category": "external",
"summary": "https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0",
"url": "https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0"
}
],
"release_date": "2024-01-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "krb5: overflow when calculating ulog block size"
},
{
"cve": "CVE-2025-26465",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2025-02-10T21:56:03.853000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2344780"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client\u0027s memory resource first, turning the attack complexity high.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated as a moderate severity vulnerability instead of important because it requires specific conditions to be exploitable. First, the OpenSSH client must have the VerifyHostKeyDNS option enabled, which is disabled by default in Red Hat Enterprise Linux (RHEL). \n\nAdditionally, while the attack allows a machine-in-the-middle (MITM) adversary to trick the client into accepting an incorrect host key, it does not directly lead to code execution or immediate system compromise. Instead, the attack requires additional steps, such as credential interception or session hijacking to fully exploit the breach.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-390: Detection of Error Condition Without Action vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nThe platform runs containerized workloads managed by liveness and readiness probes, ensuring applications recover from failures and do not operate in an unhealthy or insecure state. Firewalls are configured to fail securely, blocking unauthorized or malicious traffic during system failures or misconfigurations. Event logs are centrally collected and analyzed to detect recurring errors, crashes, and anomalous behavior. Error conditions are handled securely and audibly, ensuring failures are logged and addressed rather than ignored.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"known_not_affected": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-26465"
},
{
"category": "external",
"summary": "RHBZ#2344780",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2344780"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-26465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-26465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26465"
},
{
"category": "external",
"summary": "https://seclists.org/oss-sec/2025/q1/144",
"url": "https://seclists.org/oss-sec/2025/q1/144"
}
],
"release_date": "2025-02-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-06-02T14:07:46+00:00",
"details": "The containers required to run Discovery can be installed through discovery-installer RPM. See the official documentation for more details.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:8385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:ad1045aa0de937c3a6969ec377f7bfeda9a44ee434a954e8245e9840316ffc1c_arm64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-server-rhel9@sha256:f33991d766b618a128fb99fbe4f9b61c5004f7c6aa73b2b38e28d59e56c64d63_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:492e412759cf0eedfa5b557f7b0865f8864f84d0ed75e11dc8d7a840837d9644_amd64",
"Red Hat Discovery 1.14:registry.redhat.io/discovery/discovery-ui-rhel9@sha256:c960fa13577db72b52765d6941688f431f61fe38adb717b2d8bb6569e241bc5e_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…