{
  "threat_severity" : "Moderate",
  "public_date" : "2021-03-10T00:00:00Z",
  "bugzilla" : {
    "description" : "golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader",
    "id" : "1937901",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1937901"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-835",
  "details" : [ "encoding/xml in Go before 1.15.9 and 1.16.x before 1.16.1 has an infinite loop if a custom TokenReader (for xml.NewTokenDecoder) returns EOF in the middle of an element. This can occur in the Decode, DecodeElement, or Skip method.", "An infinite loop vulnerability was found in golang. If an application defines a custom token parser initializing with `xml.NewTokenDecoder` it is possible for the parsing loop to never return. An attacker could potentially craft a malicious XML document which has an XML element with `EOF` within it, causing the parsing application to endlessly loop, resulting in a Denial of Service (DoS)." ],
  "statement" : "OpenShift Container Platform (OCP), OpenShift ServiceMesh (OSSM),  Red Hat OpenShift Jaeger (RHOSJ) and OpenShift Virtualization all bundle vulnerable versions of the golang standard library (stdlib). However, no component within each product utilizes the function xml.NewTokenDecoder which is a requirement to be vulnerable. Hence, all affected components are marked as \"Will not fix\". Additionally no OCP container has been listed, as nearly all available containers are compiled with an affected version of Go, but do not utilize the function xml.NewTokenDecoder.\nRed Hat Ceph Storage (RHCS), Red Hat Gluster Storage 3 and OpenShift Container Storage 4 also bundles a vulnerable version of golang standard library 'encoding/xml', but does not utilize the function xml.NewTokenDecoder, and hence this issue has been rated as having a security impact of Low.",
  "affected_release" : [ {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/client-kn-rhel8:0.22.0-4"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-controller-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-mtbroker-filter-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-mtbroker-ingress-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-mtchannel-broker-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-mtping-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-storage-version-migration-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-sugar-controller-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/eventing-webhook-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/ingress-rhel8-operator:1.16.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/knative-rhel8-operator:1.16.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/kn-cli-artifacts-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/kourier-control-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/net-istio-controller-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/net-istio-webhook-rhel8:0.22.0-2"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serverless-operator-bundle:1.16.0-6"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serverless-rhel8-operator:1.16.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-activator-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-autoscaler-hpa-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-autoscaler-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-controller-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-domain-mapping-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-domain-mapping-webhook-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-queue-rhel8:0.22.0-4"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-storage-version-migration-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/serving-webhook-rhel8:0.22.0-3"
  }, {
    "product_name" : "Openshift Serveless 1.16",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2705",
    "cpe" : "cpe:/a:redhat:serverless:1.16::el8",
    "package" : "openshift-serverless-1/svls-must-gather-rhel8:1.16.0-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/client-kn-rhel8:0.23.2-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-apiserver-receive-adapter-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-controller-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-in-memory-channel-controller-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-in-memory-channel-dispatcher-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-mtbroker-filter-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-mtbroker-ingress-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-mtchannel-broker-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-mtping-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-storage-version-migration-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-sugar-controller-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/eventing-webhook-rhel8:0.23.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/ingress-rhel8-operator:1.17.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/knative-rhel8-operator:1.17.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/kn-cli-artifacts-rhel8:0.23.2-1"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/kourier-control-rhel8:0.23.0-4"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/net-istio-controller-rhel8:0.23.0-4"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/net-istio-webhook-rhel8:0.23.0-4"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serverless-operator-bundle:1.17.0-11"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serverless-rhel8-operator:1.17.0-5"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-activator-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-autoscaler-hpa-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-autoscaler-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-controller-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-domain-mapping-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-domain-mapping-webhook-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-queue-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-storage-version-migration-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/serving-webhook-rhel8:0.23.1-2"
  }, {
    "product_name" : "Openshift Serverless 1.17",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3556",
    "cpe" : "cpe:/a:redhat:serverless:1.17::el8",
    "package" : "openshift-serverless-1/svls-must-gather-rhel8:1.17.0-5"
  }, {
    "product_name" : "Openshift Serverless 1 on RHEL 8",
    "release_date" : "2021-07-13T00:00:00Z",
    "advisory" : "RHSA-2021:2704",
    "cpe" : "cpe:/a:redhat:serverless:1.0::el8",
    "package" : "openshift-serverless-clients-0:0.22.0-3.el8"
  }, {
    "product_name" : "Openshift Serverless 1 on RHEL 8",
    "release_date" : "2021-09-16T00:00:00Z",
    "advisory" : "RHSA-2021:3555",
    "cpe" : "cpe:/a:redhat:serverless:1.0::el8",
    "package" : "openshift-serverless-clients-0:0.23.2-1.el8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2021-08-10T00:00:00Z",
    "advisory" : "RHSA-2021:3076",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "go-toolset:rhel8-8040020210716085908.5081a262"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/cephcsi-rhel8:4.8-125.01872cc.release_4.8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/mcg-core-rhel8:5.8.0-38.e060925.5.8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/mcg-rhel8-operator:5.8.0-27.4a6ca5f.5.8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/ocs-must-gather-rhel8:4.8-196.a35d7d7.release_4.8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/ocs-operator-bundle:4.8.0-5",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/ocs-rhel8-operator:4.8-196.a35d7d7.release_4.8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/rook-ceph-rhel8-operator:4.8-167.9a9db5f.release_4.8",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Container Storage 4.8.0 on RHEL-8",
    "release_date" : "2021-08-03T00:00:00Z",
    "advisory" : "RHBA-2021:3003",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4.8::el8",
    "package" : "ocs4/volume-replication-rhel8-operator:4.8-20.ab575a2.release_v0.1",
    "impact" : "low"
  } ],
  "package_state" : [ {
    "product_name" : "Distributed Tracing Jaeger 1",
    "fix_state" : "Will not fix",
    "package_name" : "distributed-tracing/jaeger-all-in-one-rhel8",
    "cpe" : "cpe:/a:redhat:jaeger:1.17::el7"
  }, {
    "product_name" : "Distributed Tracing Jaeger 1",
    "fix_state" : "Will not fix",
    "package_name" : "distributed-tracing/jaeger-collector-rhel8",
    "cpe" : "cpe:/a:redhat:jaeger:1.17::el7"
  }, {
    "product_name" : "Distributed Tracing Jaeger 1",
    "fix_state" : "Will not fix",
    "package_name" : "distributed-tracing/jaeger-rhel8-operator",
    "cpe" : "cpe:/a:redhat:jaeger:1.17::el7"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Will not fix",
    "package_name" : "knative-eventing",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Will not fix",
    "package_name" : "knative-serving",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Service Mesh 2.0",
    "fix_state" : "Will not fix",
    "package_name" : "servicemesh",
    "cpe" : "cpe:/a:redhat:service_mesh:2.0"
  }, {
    "product_name" : "OpenShift Service Mesh 2.0",
    "fix_state" : "Will not fix",
    "package_name" : "servicemesh-grafana",
    "cpe" : "cpe:/a:redhat:service_mesh:2.0"
  }, {
    "product_name" : "OpenShift Service Mesh 2.0",
    "fix_state" : "Will not fix",
    "package_name" : "servicemesh-operator",
    "cpe" : "cpe:/a:redhat:service_mesh:2.0"
  }, {
    "product_name" : "OpenShift Service Mesh 2.0",
    "fix_state" : "Will not fix",
    "package_name" : "servicemesh-prometheus",
    "cpe" : "cpe:/a:redhat:service_mesh:2.0"
  }, {
    "product_name" : "Red Hat Ceph Storage 2",
    "fix_state" : "Out of support scope",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:ceph_storage:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 2",
    "fix_state" : "Out of support scope",
    "package_name" : "grafana",
    "cpe" : "cpe:/a:redhat:ceph_storage:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:ceph_storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "golang-github-prometheus-node_exporter",
    "cpe" : "cpe:/a:redhat:ceph_storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "grafana",
    "cpe" : "cpe:/a:redhat:ceph_storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ceph Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "grafana-container",
    "cpe" : "cpe:/a:redhat:ceph_storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Ceph Storage 4",
    "fix_state" : "Fix deferred",
    "package_name" : "rhceph/rhceph-4-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:ceph_storage:4",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "buildah",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "gcc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "gcc-libraries",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "golang",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "container-tools:1.0/buildah",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "container-tools:2.0/buildah",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "container-tools:rhel8/buildah",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "gcc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "gcc-toolset-10-gcc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "gcc-toolset-9-gcc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "buildah",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "gcc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "golang",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "atomic-openshift",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "cri-o",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "cri-o",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "cri-tools",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-clients",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat Openshift Container Storage 4",
    "fix_state" : "Affected",
    "package_name" : "mcg",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Openshift Container Storage 4",
    "fix_state" : "Affected",
    "package_name" : "odf4/ocs-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "container-native-virtualization/vm-import-controller",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "container-native-virtualization/vm-import-controller-rhel8",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "hostpath-provisioner-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "hostpath-provisioner-operator-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "hyperconverged-cluster-operator-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "hyperconverged-cluster-webhook-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "kubevirt-cpu-model-nfd-plugin",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "kubevirt-vmware-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "node-maintenance-operator-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "virt-cdi-apiserver-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "virt-handler-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 2",
    "fix_state" : "Will not fix",
    "package_name" : "virt-launcher-container",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:2"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Not affected",
    "package_name" : "etcd",
    "cpe" : "cpe:/a:redhat:storage:3"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Will not fix",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:storage:3"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "grafana",
    "cpe" : "cpe:/a:redhat:storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Fix deferred",
    "package_name" : "heketi",
    "cpe" : "cpe:/a:redhat:storage:3",
    "impact" : "low"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Not affected",
    "package_name" : "rhgs3/rhgs-gluster-block-prov-rhel7",
    "cpe" : "cpe:/a:redhat:storage:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2021-27918\nhttps://nvd.nist.gov/vuln/detail/CVE-2021-27918\nhttps://groups.google.com/g/golang-announce/c/MfiLYjG-RAw" ],
  "name" : "CVE-2021-27918",
  "csaw" : false
}