{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-25173", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-02-03T16:59:18.247Z", "datePublished": "2023-02-16T14:09:12.073Z", "dateUpdated": "2025-03-10T21:10:38.648Z"}, "containers": {"cna": {"title": "containerd supplementary groups are not set up properly", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p"}, {"name": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"}, {"name": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"}, {"name": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96"}, {"name": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp"}, {"name": "https://github.com/advisories/GHSA-phjr-8j92-w5v7", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-phjr-8j92-w5v7"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.5.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/releases/tag/v1.5.18"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.6.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/releases/tag/v1.6.18"}, {"name": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/", "tags": ["x_refsource_MISC"], "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"}], "affected": [{"vendor": "containerd", "product": "containerd", "versions": [{"version": "< 1.5.18", "status": "affected"}, {"version": ">= 1.6.0, < 1.6.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-15T20:06:31.329Z"}, "descriptions": [{"lang": "en", "value": "containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups."}], "source": {"advisory": "GHSA-hmfx-3pcx-653p", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:18:35.671Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p"}, {"name": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"}, {"name": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"}, {"name": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96"}, {"name": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp"}, {"name": "https://github.com/advisories/GHSA-phjr-8j92-w5v7", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/advisories/GHSA-phjr-8j92-w5v7"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.5.18", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/containerd/containerd/releases/tag/v1.5.18"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.6.18", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/containerd/containerd/releases/tag/v1.6.18"}, {"name": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-10T21:00:44.060345Z", "id": "CVE-2023-25173", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:10:38.648Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-25173", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-02-03T16:59:18.247Z", "datePublished": "2023-02-16T14:09:12.073Z", "dateUpdated": "2025-03-10T21:10:38.648Z"}, "containers": {"cna": {"title": "containerd supplementary groups are not set up properly", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p"}, {"name": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4", "tags": ["x_refsource_MISC"], "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"}, {"name": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"}, {"name": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96"}, {"name": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp"}, {"name": "https://github.com/advisories/GHSA-phjr-8j92-w5v7", "tags": ["x_refsource_MISC"], "url": "https://github.com/advisories/GHSA-phjr-8j92-w5v7"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.5.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/releases/tag/v1.5.18"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.6.18", "tags": ["x_refsource_MISC"], "url": "https://github.com/containerd/containerd/releases/tag/v1.6.18"}, {"name": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/", "tags": ["x_refsource_MISC"], "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"}], "affected": [{"vendor": "containerd", "product": "containerd", "versions": [{"version": "< 1.5.18", "status": "affected"}, {"version": ">= 1.6.0, < 1.6.18", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-09-15T20:06:31.329Z"}, "descriptions": [{"lang": "en", "value": "containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups."}], "source": {"advisory": "GHSA-hmfx-3pcx-653p", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:18:35.671Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p"}, {"name": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"}, {"name": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"}, {"name": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96"}, {"name": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp"}, {"name": "https://github.com/advisories/GHSA-phjr-8j92-w5v7", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/advisories/GHSA-phjr-8j92-w5v7"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.5.18", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/containerd/containerd/releases/tag/v1.5.18"}, {"name": "https://github.com/containerd/containerd/releases/tag/v1.6.18", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/containerd/containerd/releases/tag/v1.6.18"}, {"name": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/", "tags": ["x_transferred"]}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-25173", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-10T21:00:44.060345Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-10T21:00:45.592Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*", "matchCriteriaId": "4C98A2DA-3CDD-4438-AECC-DDDA67E61935", "versionEndExcluding": "1.5.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:linuxfoundation:containerd:*:*:*:*:*:*:*:*", "matchCriteriaId": "BDD5FC3E-BEEB-4CAA-845E-3BADF39E46B2", "versionEndExcluding": "1.6.18", "versionStartIncluding": "1.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\n\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups."}, {"lang": "es", "value": "Containerd es contenedor de c\u00f3digo abierto en tiempo de ejecuci\u00f3n. Se encontr\u00f3 un error en Containerd antes de las versiones 1.6.18 y 1.5.18 donde los grupos suplementarios no est\u00e1n configurados correctamente dentro de un contenedor. Si un atacante tiene acceso directo a un contenedor y manipula su acceso de grupo suplementario, es posible que pueda utilizar el acceso de grupo suplementario para eludir las restricciones del grupo primario en algunos casos, obteniendo potencialmente acceso a informaci\u00f3n confidencial o obteniendo la capacidad de ejecutar c\u00f3digo en ese contenedor. Las aplicaciones posteriores que utilizan la librer\u00eda cliente en containerd tambi\u00e9n pueden verse afectadas. Este error se ha solucionado en Containerd v1.6.18 y v.1.5.18. Los usuarios deben actualizar a estas versiones y volver a crear containers para resolver este problema. Los usuarios que dependen de una aplicaci\u00f3n posterior que utiliza la librer\u00eda cliente de Containerd deben verificar esa aplicaci\u00f3n para obtener avisos e instrucciones por separado. Como workaround, aseg\u00farese de que no se utilice la instrucci\u00f3n de Dockerfile `\"USER $USERNAME\"`. En su lugar, establezca el punto de entrada del contenedor en un valor similar a `ENTRYPOINT [\"su\", \"-\", \"user\"]` para permitir que `su` configure correctamente grupos suplementarios."}], "id": "CVE-2023-25173", "lastModified": "2024-11-21T07:49:15.083", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-16T15:15:20.057", "references": [{"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-phjr-8j92-w5v7"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/containerd/containerd/releases/tag/v1.5.18"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/containerd/containerd/releases/tag/v1.6.18"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p"}, {"source": "security-advisories@github.com", "tags": ["Not Applicable"], "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"}, {"source": "security-advisories@github.com", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-4wjj-jwc9-2x96"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-fjm8-m7m6-2fjp"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/advisories/GHSA-phjr-8j92-w5v7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/containerd/containerd/releases/tag/v1.5.18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/containerd/containerd/releases/tag/v1.6.18"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYZOKMMVX4SIEHPJW3SJUQGMO5YZCPHC/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XNF4OLYZRQE75EB5TW5N42FSXHBXGWFE/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTE4ITXXPIWZEQ4HYQCB6N6GZIMWXDAI/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2023:5314", "cpe": "cpe:/a:redhat:openshift_api_data_protection:1.1::el8", "impact": "low", "package": "oadp/oadp-velero-plugin-rhel8:1.1.6-5", "product_name": "OADP-1.1-RHEL-8", "release_date": "2023-09-20T00:00:00Z"}, {"advisory": "RHSA-2023:3450", "cpe": "cpe:/a:redhat:serverless:1.0::el8", "package": "openshift-serverless-clients-0:1.8.1-3.el8", "product_name": "Openshift Serverless 1 on RHEL 8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:6939", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "container-tools:rhel8-8090020230825121312.e7857ab1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-11-14T00:00:00Z"}, {"advisory": "RHSA-2023:6473", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "buildah-1:1.31.3-1.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}, {"advisory": "RHSA-2023:6474", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "podman-2:4.6.1-5.el9", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-11-07T00:00:00Z"}, {"advisory": "RHSA-2023:2107", "cpe": "cpe:/a:redhat:rhmt:1.7::el8", "package": "rhmtc/openshift-migration-controller-rhel8:v1.7.9-4", "product_name": "Red Hat Migration Toolkit for Containers 1.7", "release_date": "2023-05-04T00:00:00Z"}, {"advisory": "RHSA-2023:2107", "cpe": "cpe:/a:redhat:rhmt:1.7::el8", "package": "rhmtc/openshift-velero-plugin-rhel8:v1.7.9-4", "product_name": "Red Hat Migration Toolkit for Containers 1.7", "release_date": "2023-05-04T00:00:00Z"}, {"advisory": "RHSA-2023:4488", "cpe": "cpe:/a:redhat:openshift:4.11::el8", "impact": "low", "package": "openshift4-wincw/windows-machine-config-rhel8-operator:6.0.1-38", "product_name": "Red Hat OpenShift Container Platform 4.11", "release_date": "2023-08-07T00:00:00Z"}, {"advisory": "RHSA-2023:4025", "cpe": "cpe:/a:redhat:openshift:4.12::el8", "impact": "low", "package": "openshift4-wincw/windows-machine-config-rhel8-operator:7.1.0-42", "product_name": "Red Hat OpenShift Container Platform 4.12", "release_date": "2023-07-18T00:00:00Z"}, {"advisory": "RHSA-2023:4671", "cpe": "cpe:/a:redhat:openshift:4.12::el8", "impact": "low", "package": "openshift4/ose-docker-builder:v4.12.0-202308091944.p0.g1f99147.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.12", "release_date": "2023-08-23T00:00:00Z"}, {"advisory": "RHSA-2023:1326", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "impact": "low", "package": "openshift4/oc-mirror-plugin-rhel8:v4.13.0-202305091542.p0.gbee629a.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-05-17T00:00:00Z"}, {"advisory": "RHSA-2023:1326", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "impact": "low", "package": "openshift4/ose-installer:v4.13.0-202305091542.p0.g44db7b2.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-05-17T00:00:00Z"}, {"advisory": "RHSA-2023:1326", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "impact": "low", "package": "openshift4/ose-operator-marketplace:v4.13.0-202305021528.p0.gd569c22.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-05-17T00:00:00Z"}, {"advisory": "RHSA-2023:3537", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "impact": "low", "package": "openshift4/ose-docker-builder:v4.13.0-202306050632.p0.gd02643e.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-06-13T00:00:00Z"}, {"advisory": "RHSA-2023:4226", "cpe": "cpe:/a:redhat:openshift:4.13::el8", "impact": "low", "package": "openshift4/ose-openshift-apiserver-rhel8:v4.13.0-202307170916.p0.g0b82768.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-07-27T00:00:00Z"}, {"advisory": "RHSA-2023:1372", "cpe": "cpe:/a:redhat:openshift:4.13::el9", "impact": "low", "package": "openshift4-wincw/windows-machine-config-rhel9-operator:8.0.0-47", "product_name": "Red Hat OpenShift Container Platform 4.13", "release_date": "2023-05-10T00:00:00Z"}, {"advisory": "RHSA-2023:5006", "cpe": "cpe:/a:redhat:openshift:4.14::el8", "impact": "low", "package": "openshift4/oc-mirror-plugin-rhel8:v4.14.0-202310201027.p0.g68cf97e.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.14", "release_date": "2023-10-31T00:00:00Z"}, {"advisory": "RHSA-2023:5006", "cpe": "cpe:/a:redhat:openshift:4.14::el8", "impact": "low", "package": "openshift4/ose-installer:v4.14.0-202310201027.p0.g03546e5.assembly.stream", "product_name": "Red Hat OpenShift Container Platform 4.14", "release_date": "2023-10-31T00:00:00Z"}, {"advisory": "RHSA-2023:2029", "cpe": "cpe:/a:redhat:openshift_security_profiles_operator_stable:::el8", "package": "compliance/openshift-security-profiles-rhel8-operator:0.7.1-3", "product_name": "Red Hat OpenShift Security Profiles Operator stable on RHEL-8", "release_date": "2023-05-10T00:00:00Z"}, {"advisory": "RHSA-2023:6817", "cpe": "cpe:/a:redhat:container_native_virtualization:4.14::el9", "package": "container-native-virtualization/cluster-network-addons-operator-rhel9:v4.14.0-34", "product_name": "RHEL-9-CNV-4.14", "release_date": "2023-11-08T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/client-kn-rhel8:1.8.1-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-controller-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-kafka-broker-controller-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-kafka-broker-dispatcher-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-kafka-broker-post-install-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-kafka-broker-receiver-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-kafka-broker-webhook-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-mtbroker-filter-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-mtbroker-ingress-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-mtchannel-broker-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-mtping-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-storage-version-migration-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/eventing-webhook-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/func-utils-rhel8:1.29.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/ingress-rhel8-operator:1.29.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/knative-rhel8-operator:1.29.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/kn-cli-artifacts-rhel8:1.8.1-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/kourier-control-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/net-istio-controller-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/net-istio-webhook-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serverless-operator-bundle:1.29.0-4", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serverless-rhel8-operator:1.29.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-activator-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-autoscaler-hpa-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-autoscaler-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-controller-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-domain-mapping-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-domain-mapping-webhook-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-queue-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-storage-version-migration-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/serving-webhook-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1/svls-must-gather-rhel8:1.29.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1-tech-preview/knative-client-plugin-event-sender-rhel8:1.8.0-3", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}, {"advisory": "RHSA-2023:3455", "cpe": "cpe:/a:redhat:openshift_serverless:1.29::el8", "package": "openshift-serverless-1-tech-preview/logic-data-index-ephemeral-rhel8:1.29.0-1", "product_name": "RHOSS-1.29-RHEL-8", "release_date": "2023-06-05T00:00:00Z"}], "bugzilla": {"description": "containerd: Supplementary groups are not set up properly", "id": "2174485", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2174485"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "status": "verified"}, "cwe": "CWE-842", "details": ["containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well.\nThis bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `\"USER $USERNAME\"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT [\"su\", \"-\", \"user\"]` to allow `su` to properly set up supplementary groups.", "A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases. This issue can allow access to sensitive information or gain the ability to execute code in that container."], "name": "CVE-2023-25173", "package_state": [{"cpe": "cpe:/a:redhat:cert_manager:1", "fix_state": "Will not fix", "package_name": "cert-manager/jetstack-cert-manager-rhel9", "product_name": "cert-manager Operator for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:cryostat:2", "fix_state": "Will not fix", "package_name": "cryostat-tech-preview/cryostat-rhel8-operator", "product_name": "Cryostat 2"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "impact": "low", "package_name": "openshift-logging/logging-loki-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "impact": "low", "package_name": "openshift-logging/lokistack-gateway-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "impact": "low", "package_name": "openshift-logging/opa-openshift-rhel8", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:migration_toolkit_virtualization:2", "fix_state": "Affected", "package_name": "migration-toolkit-virtualization/mtv-controller-rhel9", "product_name": "Migration Toolkit for Virtualization"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "helm", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Will not fix", "package_name": "jenkins-operator-container", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Affected", "package_name": "odo", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Will not fix", "package_name": "openshift-service-mesh/istio-rhel8-operator", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:service_mesh:2", "fix_state": "Will not fix", "package_name": "openshift-service-mesh/prometheus-rhel8", "product_name": "OpenShift Service Mesh 2"}, {"cpe": "cpe:/a:redhat:service_mesh:2.1", "fix_state": "Fix deferred", "impact": "low", "package_name": "servicemesh-prometheus", "product_name": "OpenShift Service Mesh 2.1"}, {"cpe": "cpe:/a:redhat:red_hat_3scale_amp:2", "fix_state": "Affected", "package_name": "3scale-operator-container", "product_name": "Red Hat 3scale API Management Platform 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "acm-multicluster-globalhub-agent-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-cluster-proxy-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-governance-policy-addon-controller-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-governance-policy-framework-addon-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-grafana-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-prometheus-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-search-v2-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/acm-volsync-addon-controller-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/cert-policy-controller-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/cluster-backup-rhel9-operator", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/config-policy-controller-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/governance-policy-propagator-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/governance-policy-spec-sync-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/governance-policy-status-sync-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/governance-policy-template-sync-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/iam-policy-controller-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/multiclusterhub-repo-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/multiclusterhub-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/multicluster-operators-application-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/multicluster-operators-channel-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/multicluster-operators-subscription-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/observatorium-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/prometheus-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/rbac-query-proxy-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/search-collector-rhel9", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/thanos-receive-controller-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Not affected", "impact": "low", "package_name": "rhacm2/thanos-rhel7", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:3", "fix_state": "Fix deferred", "impact": "low", "package_name": "advanced-cluster-security/rhacs-main-rhel8", "product_name": "Red Hat Advanced Cluster Security 3"}, {"cpe": "cpe:/a:redhat:advanced_cluster_security:3", "fix_state": "Fix deferred", "impact": "low", "package_name": "advanced-cluster-security/rhacs-scanner-rhel8", "product_name": "Red Hat Advanced Cluster Security 3"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform", "fix_state": "Will not fix", "package_name": "helm", "product_name": "Red Hat Ansible Automation Platform 1.2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 1.2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "openshift-clients", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "buildah", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "podman", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "container-tools:3.0/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "container-tools:3.0/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:3.0/skopeo", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "container-tools:4.0/buildah", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:4.0/conmon", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:4.0/podman", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "container-tools:4.0/skopeo", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "conmon", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "skopeo", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:3.11", "fix_state": "Affected", "impact": "low", "package_name": "atomic-openshift", "product_name": "Red Hat OpenShift Container Platform 3.11"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "low", "package_name": "buildah", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "conmon", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "cri-o", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "low", "package_name": "openshift4/dpu-network-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/kubernetes-nmstate-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/metallb-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/metallb-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-agent-installer-api-server-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-agent-installer-csr-approver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-agent-installer-node-agent-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-alibaba-cloud-controller-manager-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-alibaba-cloud-csi-driver-container-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-aws-cluster-api-controllers-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-aws-ebs-csi-driver-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-aws-efs-csi-driver-container-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-azure-cluster-api-controllers-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-azure-disk-csi-driver-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-azure-file-csi-driver-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-capacity", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-cluster-capi-operator-container-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-cluster-capi-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-ingress-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-cluster-kube-cluster-api-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-monitoring-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-network-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-node-tuning-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-cluster-platform-operators-manager-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-policy-controller-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-cluster-storage-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-cluster-version-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-container-networking-plugins-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-driver-manila-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-driver-nfs-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-driver-shared-resource-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-external-provisioner", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-external-provisioner-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-snapshot-controller", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-csi-snapshot-controller-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-docker-registry", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-gcp-cloud-controller-manager-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-gcp-filestore-csi-driver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-gcp-pd-csi-driver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-grafana", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "low", "package_name": "openshift4/ose-hypershift-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-ibm-vpc-block-csi-driver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-kubernetes-nmstate-handler-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-local-storage-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-local-storage-static-provisioner", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-machine-api-provider-openstack-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-machine-config-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-metering-ansible-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-metering-helm-container-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-multus-admission-controller-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-multus-cni", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-multus-networkpolicy-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-network-interface-bond-cni-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "low", "package_name": "openshift4/ose-node-feature-discovery", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-node-problem-detector-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-oauth-apiserver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-olm-rukpak-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-openshift-controller-manager-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-operator-registry-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-operator-sdk-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-pod", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-powervs-block-csi-driver-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-prometheus", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-prometheus-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-prom-label-proxy", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-ptp-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-sdn-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-sriov-network-webhook", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "openshift4/ose-tests", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-thanos-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-vsphere-cloud-controller-manager-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/ose-vsphere-cluster-api-controllers-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ose-vsphere-csi-driver-syncer-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift4/special-resource-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/topology-aware-lifecycle-manager-rhel8-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift4/ztp-site-generate-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "openshift-clients", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "impact": "low", "package_name": "openshift-security-profiles-operator-container", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "impact": "low", "package_name": "openshift-tech-preview/metallb-rhel8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "podman", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "impact": "low", "package_name": "redhat/redhat-operator-index", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "impact": "low", "package_name": "skopeo", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:assisted_installer:", "fix_state": "Out of support scope", "package_name": "rhai-tech-preview/assisted-installer-agent-rhel8", "product_name": "Red Hat OpenShift Container Platform Assisted Installer"}, {"cpe": "cpe:/a:redhat:assisted_installer:", "fix_state": "Out of support scope", "package_name": "rhai-tech-preview/assisted-installer-rhel8", "product_name": "Red Hat OpenShift Container Platform Assisted Installer"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Affected", "impact": "low", "package_name": "ocs4/cephcsi-rhel8", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Affected", "impact": "low", "package_name": "ocs4/mcg-rhel8-operator", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Affected", "impact": "low", "package_name": "ocs4/ocs-rhel8-operator", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Affected", "impact": "low", "package_name": "ocs4/rook-ceph-rhel8-operator", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/cephcsi-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/mcg-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/ocs-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/odf-csi-addons-sidecar-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/odf-lvm-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/odf-multicluster-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/odf-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/odr-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Affected", "impact": "low", "package_name": "odf4/rook-ceph-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_science", "fix_state": "Fix deferred", "impact": "low", "package_name": "rhods/odh-ml-pipelines-cache-rhel8", "product_name": "Red Hat OpenShift Data Science (RHODS)"}, {"cpe": "cpe:/a:redhat:openshift_data_science", "fix_state": "Fix deferred", "impact": "low", "package_name": "rhods/odh-modelmesh-serving-controller-rhel8", "product_name": "Red Hat OpenShift Data Science (RHODS)"}, {"cpe": "cpe:/a:redhat:openshift_data_science", "fix_state": "Fix deferred", "impact": "low", "package_name": "rhods/odh-operator-base-rhel8", "product_name": "Red Hat OpenShift Data Science (RHODS)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Affected", "package_name": "devspaces/traefik-rhel8", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_distributed_tracing:2", "fix_state": "Affected", "package_name": "rhosdt/opentelemetry-rhel8-operator", "product_name": "Red Hat OpenShift distributed tracing 2"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/applicationset-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/argocd-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/gitops-rhel8-operator", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_gitops:1", "fix_state": "Affected", "package_name": "openshift-gitops-1/kam-delivery-rhel8", "product_name": "Red Hat OpenShift GitOps"}, {"cpe": "cpe:/a:redhat:openshift_sandboxed_containers:1", "fix_state": "Affected", "package_name": "openshift-sandboxed-containers/osc-rhel8-operator", "product_name": "Red Hat Openshift Sandboxed Containers"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "container-native-virtualization/cluster-network-addons-operator", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Will not fix", "package_name": "container-native-virtualization/kubernetes-nmstate-handler-rhel8", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:container_native_virtualization:4", "fix_state": "Affected", "package_name": "container-native-virtualization/multus-dynamic-networks-rhel9", "product_name": "Red Hat OpenShift Virtualization 4"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel8/osp-director-agent", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Will not fix", "package_name": "quay/quay-builder-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Will not fix", "package_name": "quay/quay-operator-rhel8", "product_name": "Red Hat Quay 3"}], "public_date": "2023-02-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-25173\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-25173\nhttps://github.com/containerd/containerd/commit/133f6bb6cd827ce35a5fb279c1ead12b9d21460a\nhttps://github.com/containerd/containerd/releases/tag/v1.5.18\nhttps://github.com/containerd/containerd/releases/tag/v1.6.18\nhttps://github.com/containerd/containerd/security/advisories/GHSA-hmfx-3pcx-653p\nhttps://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/"], "statement": "The following products include containerd related code, but do not use the specific Go packages impacted by this CVE, `containerd/cri/server` and `containerd/oci`. This CVE is therefore rated Low for these products:\n* OpenShift Container Platform\n* OpenShift Service Mesh\n* OpenShift API for Data Protection\n* Red Hat Advanced Cluster Security\n* Red Hat Advanced Cluster Management for Kubernetes", "threat_severity": "Moderate"}