{
  "threat_severity" : "Moderate",
  "public_date" : "2024-09-10T15:15:17Z",
  "bugzilla" : {
    "description" : "serve-static: Improper Sanitization in serve-static",
    "id" : "2311154",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2311154"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-79",
  "details" : [ "serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.", "A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect()." ],
  "statement" : "rhdh-hub-container 1.2 and 1.3 have included patches for this vulnerability.",
  "affected_release" : [ {
    "product_name" : "Discovery 1 for RHEL 9",
    "release_date" : "2025-02-10T00:00:00Z",
    "advisory" : "RHSA-2025:1249",
    "cpe" : "cpe:/o:redhat:discovery:1.0::el9",
    "package" : "discovery/discovery-server-rhel9:1.12.0-1"
  }, {
    "product_name" : "Discovery 1 for RHEL 9",
    "release_date" : "2025-02-10T00:00:00Z",
    "advisory" : "RHSA-2025:1249",
    "cpe" : "cpe:/o:redhat:discovery:1.0::el9",
    "package" : "discovery/discovery-ui-rhel9:1.12.0-1"
  }, {
    "product_name" : "HawtIO 4.0.0 for Red Hat build of Apache Camel 4",
    "release_date" : "2024-12-12T00:00:00Z",
    "advisory" : "RHSA-2024:11023",
    "cpe" : "cpe:/a:redhat:rhboac_hawtio:4.0.0",
    "package" : "serve-static"
  }, {
    "product_name" : "NETWORK-OBSERVABILITY-1.7.0-RHEL-9",
    "release_date" : "2024-10-22T00:00:00Z",
    "advisory" : "RHSA-2024:8014",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1.7.0::el9",
    "package" : "network-observability/network-observability-cli-rhel9:v1.7.0-67"
  }, {
    "product_name" : "NETWORK-OBSERVABILITY-1.7.0-RHEL-9",
    "release_date" : "2024-10-22T00:00:00Z",
    "advisory" : "RHSA-2024:8014",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1.7.0::el9",
    "package" : "network-observability/network-observability-console-plugin-rhel9:v1.7.0-67"
  }, {
    "product_name" : "NETWORK-OBSERVABILITY-1.7.0-RHEL-9",
    "release_date" : "2024-10-22T00:00:00Z",
    "advisory" : "RHSA-2024:8014",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1.7.0::el9",
    "package" : "network-observability/network-observability-ebpf-agent-rhel9:v1.7.0-67"
  }, {
    "product_name" : "NETWORK-OBSERVABILITY-1.7.0-RHEL-9",
    "release_date" : "2024-10-22T00:00:00Z",
    "advisory" : "RHSA-2024:8014",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1.7.0::el9",
    "package" : "network-observability/network-observability-flowlogs-pipeline-rhel9:v1.7.0-67"
  }, {
    "product_name" : "NETWORK-OBSERVABILITY-1.7.0-RHEL-9",
    "release_date" : "2024-10-22T00:00:00Z",
    "advisory" : "RHSA-2024:8014",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1.7.0::el9",
    "package" : "network-observability/network-observability-operator-bundle:1.7.0-86"
  }, {
    "product_name" : "NETWORK-OBSERVABILITY-1.7.0-RHEL-9",
    "release_date" : "2024-10-22T00:00:00Z",
    "advisory" : "RHSA-2024:8014",
    "cpe" : "cpe:/a:redhat:network_observ_optr:1.7.0::el9",
    "package" : "network-observability/network-observability-rhel9-operator:v1.7.0-67"
  }, {
    "product_name" : "Red Hat Developer Hub 1.3 on RHEL 9",
    "release_date" : "2024-10-02T00:00:00Z",
    "advisory" : "RHBA-2024:7523",
    "cpe" : "cpe:/a:redhat:rhdh:1.3::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1.3-100"
  }, {
    "product_name" : "Red Hat Migration Toolkit for Containers 1.8",
    "release_date" : "2024-12-10T00:00:00Z",
    "advisory" : "RHSA-2024:10906",
    "cpe" : "cpe:/a:redhat:rhmt:1.8::el8",
    "package" : "rhmtc/openshift-migration-ui-rhel8:v1.8.5-7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.17",
    "release_date" : "2025-02-05T00:00:00Z",
    "advisory" : "RHSA-2025:0875",
    "cpe" : "cpe:/a:redhat:openshift:4.17::el9",
    "package" : "openshift4/nmstate-console-plugin-rhel9:v4.17.0-202501301204.p0.gcffdc60.assembly.stream.el9"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/argocd-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/argo-rollouts-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/console-plugin-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/dex-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/gitops-operator-bundle:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/gitops-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/gitops-rhel8-operator:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/kam-delivery-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el8",
    "package" : "openshift-gitops-1/must-gather-rhel8:v1.12.6-2"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.12 - RHEL 9",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8677",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.12::el9",
    "package" : "openshift-gitops-1/argocd-rhel9:v1.12.6-1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/argocd-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/argocd-rhel9:v1.13.2-5"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/argo-rollouts-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/console-plugin-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/dex-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/gitops-operator-bundle:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/gitops-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/gitops-rhel8-operator:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/kam-delivery-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps 1.13",
    "release_date" : "2024-10-29T00:00:00Z",
    "advisory" : "RHSA-2024:8581",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1.13::el8",
    "package" : "openshift-gitops-1/must-gather-rhel8:v1.13.2-4"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/grafana-rhel8:2.4.11-2"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/istio-cni-rhel8:2.4.11-2"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/istio-must-gather-rhel8:2.4.11-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/kiali-rhel8:1.65.16-4"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/pilot-rhel8:2.4.11-2"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/proxyv2-rhel8:2.4.11-5"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.4 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7724",
    "cpe" : "cpe:/a:redhat:service_mesh:2.4::el8",
    "package" : "openshift-service-mesh/ratelimit-rhel8:2.4.11-2"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/grafana-rhel8:2.5.5-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/istio-cni-rhel8:2.5.5-4"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/istio-must-gather-rhel8:2.5.5-4"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel8:1.73.14-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/kiali-rhel8:1.73.15-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/pilot-rhel8:2.5.5-4"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/proxyv2-rhel8:2.5.5-6"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.5 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7725",
    "cpe" : "cpe:/a:redhat:service_mesh:2.5::el8",
    "package" : "openshift-service-mesh/ratelimit-rhel8:2.5.5-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/grafana-rhel8:2.6.2-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/istio-cni-rhel8:2.6.2-5"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/istio-must-gather-rhel8:2.6.2-4"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/istio-rhel8-operator:2.6.2-5"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/kiali-ossmc-rhel8:1.89.2-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/kiali-rhel8:1.89.4-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/kiali-rhel8-operator:1.89.6-1"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/pilot-rhel8:2.6.2-5"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 8",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8",
    "package" : "openshift-service-mesh/ratelimit-rhel8:2.6.2-3"
  }, {
    "product_name" : "Red Hat OpenShift Service Mesh 2.6 for RHEL 9",
    "release_date" : "2024-10-07T00:00:00Z",
    "advisory" : "RHSA-2024:7726",
    "cpe" : "cpe:/a:redhat:service_mesh:2.6::el9",
    "package" : "openshift-service-mesh/proxyv2-rhel9:2.6.2-7"
  }, {
    "product_name" : "RHODF-4.14-RHEL-9",
    "release_date" : "2025-01-15T00:00:00Z",
    "advisory" : "RHSA-2025:0323",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.14::el9",
    "package" : "odf4/ocs-client-console-rhel9:v4.14.13-3"
  }, {
    "product_name" : "RHODF-4.14-RHEL-9",
    "release_date" : "2025-01-15T00:00:00Z",
    "advisory" : "RHSA-2025:0323",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.14::el9",
    "package" : "odf4/odf-console-rhel9:v4.14.13-3"
  }, {
    "product_name" : "RHODF-4.14-RHEL-9",
    "release_date" : "2025-01-15T00:00:00Z",
    "advisory" : "RHSA-2025:0323",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.14::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:v4.14.13-3"
  }, {
    "product_name" : "RHODF-4.15-RHEL-9",
    "release_date" : "2025-01-09T00:00:00Z",
    "advisory" : "RHSA-2025:0164",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.15::el9",
    "package" : "odf4/ocs-client-console-rhel9:v4.15.9-1"
  }, {
    "product_name" : "RHODF-4.15-RHEL-9",
    "release_date" : "2025-01-09T00:00:00Z",
    "advisory" : "RHSA-2025:0164",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.15::el9",
    "package" : "odf4/odf-console-rhel9:v4.15.9-1"
  }, {
    "product_name" : "RHODF-4.15-RHEL-9",
    "release_date" : "2025-01-09T00:00:00Z",
    "advisory" : "RHSA-2025:0164",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.15::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:v4.15.9-1"
  }, {
    "product_name" : "RHODF-4.16-RHEL-9",
    "release_date" : "2024-10-15T00:00:00Z",
    "advisory" : "RHSA-2024:8113",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.16::el9",
    "package" : "odf4/mcg-core-rhel9:v4.16.3-1"
  }, {
    "product_name" : "RHODF-4.16-RHEL-9",
    "release_date" : "2025-01-08T00:00:00Z",
    "advisory" : "RHSA-2025:0082",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.16::el9",
    "package" : "odf4/ocs-client-console-rhel9:v4.16.5-2"
  }, {
    "product_name" : "RHODF-4.16-RHEL-9",
    "release_date" : "2025-01-08T00:00:00Z",
    "advisory" : "RHSA-2025:0082",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.16::el9",
    "package" : "odf4/odf-console-rhel9:v4.16.5-2"
  }, {
    "product_name" : "RHODF-4.16-RHEL-9",
    "release_date" : "2025-01-08T00:00:00Z",
    "advisory" : "RHSA-2025:0082",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.16::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:v4.16.5-2"
  }, {
    "product_name" : "RHODF-4.17-RHEL-9",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8676",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.17::el9",
    "package" : "odf4/mcg-core-rhel9:v4.17.0-69"
  }, {
    "product_name" : "RHODF-4.17-RHEL-9",
    "release_date" : "2024-10-30T00:00:00Z",
    "advisory" : "RHSA-2024:8676",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.17::el9",
    "package" : "odf4/odf-console-rhel9:v4.17.0-53"
  }, {
    "product_name" : "RHODF-4.17-RHEL-9",
    "release_date" : "2025-01-08T00:00:00Z",
    "advisory" : "RHSA-2025:0079",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.17::el9",
    "package" : "odf4/ocs-client-console-rhel9:v4.17.2-1"
  }, {
    "product_name" : "RHODF-4.17-RHEL-9",
    "release_date" : "2025-01-08T00:00:00Z",
    "advisory" : "RHSA-2025:0079",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.17::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:v4.17.2-1"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-data-index-ephemeral-rhel8:1.34.0-6"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-data-index-postgresql-rhel8:1.34.0-6"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8:1.34.0-5"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-jobs-service-postgresql-rhel8:1.34.0-6"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8:1.34.0-2"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-management-console-rhel8:1.34.0-5"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-operator-bundle:1.34.0-5"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-rhel8-operator:1.34.0-5"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-swf-builder-rhel8:1.34.0-6"
  }, {
    "product_name" : "RHOSS-1.34-RHEL-8",
    "release_date" : "2024-10-14T00:00:00Z",
    "advisory" : "RHSA-2024:8023",
    "cpe" : "cpe:/a:redhat:openshift_serverless:1.34::el8",
    "package" : "openshift-serverless-1/logic-swf-devmode-rhel8:1.34.0-6"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3.4",
    "release_date" : "2024-12-10T00:00:00Z",
    "advisory" : "RHSA-2024:10917",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3.4::el8",
    "package" : "rhosdt/jaeger-query-rhel8:sha256:56784b527bf1fc1a2a0f24ea9b6edea3927746cbe1b18d9c653e0be621f07911"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3.4",
    "release_date" : "2024-12-11T00:00:00Z",
    "advisory" : "RHSA-2024:10962",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3.4::el8",
    "package" : "rhosdt/jaeger-query-rhel8:sha256:78b4c8cb7e68b33fbd0cfb502a2d4e3ca09eeb6168d525c80ae0a45775364952"
  } ],
  "package_state" : [ {
    "product_name" : "Cryostat 3",
    "fix_state" : "Fix deferred",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:cryostat:3"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-logging/logging-view-plugin-rhel8",
    "cpe" : "cpe:/a:redhat:logging:5"
  }, {
    "product_name" : "Migration Toolkit for Applications 7",
    "fix_state" : "Will not fix",
    "package_name" : "mta/mta-cli-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:7"
  }, {
    "product_name" : "Migration Toolkit for Applications 7",
    "fix_state" : "Will not fix",
    "package_name" : "mta/mta-ui-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_applications:7"
  }, {
    "product_name" : "Migration Toolkit for Runtimes",
    "fix_state" : "Will not fix",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:migration_toolkit_runtimes:1"
  }, {
    "product_name" : "Migration Toolkit for Virtualization",
    "fix_state" : "Not affected",
    "package_name" : "migration-toolkit-virtualization/mtv-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Not affected",
    "package_name" : "multicluster-engine/console-mce-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Not affected",
    "package_name" : "multicluster-engine/multicluster-engine-console-mce-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Will not fix",
    "package_name" : "workload-availability/node-remediation-console-rhel8",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "OpenShift Lightspeed",
    "fix_state" : "Affected",
    "package_name" : "openshift-lightspeed-beta/lightspeed-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_lightspeed"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-console-plugin-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-pipelines/pipelines-hub-api-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-pipelines/pipelines-hub-db-migration-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Will not fix",
    "package_name" : "openshift-pipelines/pipelines-hub-ui-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "Red Hat 3scale API Management Platform 2",
    "fix_state" : "Will not fix",
    "package_name" : "3scale-amp-system-container",
    "cpe" : "cpe:/a:redhat:red_hat_3scale_amp:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Not affected",
    "package_name" : "rhacm2/console-rhel8",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-central-db-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Fix deferred",
    "package_name" : "advanced-cluster-security/rhacs-main-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-rhel8-operator",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-roxctl-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-v4-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "aap-cloud-ui-container",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-25/lightspeed-rhel8",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "automation-controller",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "automation-eda-controller",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat build of Apache Camel - HawtIO 4",
    "fix_state" : "Affected",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:apache_camel_hawtio:4"
  }, {
    "product_name" : "Red Hat build of OptaPlanner 8",
    "fix_state" : "Will not fix",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:optaplanner:::el6"
  }, {
    "product_name" : "Red Hat Data Grid 8",
    "fix_state" : "Will not fix",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:8"
  }, {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Not affected",
    "package_name" : "rhdh-operator-container",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "firefox",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "thunderbird",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "thunderbird",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "mozjs60",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "pcs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "gjs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "pcs",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "polkit",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Fuse 7",
    "fix_state" : "Will not fix",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jboss_fuse:7"
  }, {
    "product_name" : "Red Hat JBoss Data Grid 7",
    "fix_state" : "Will not fix",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jboss_data_grid:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 7",
    "fix_state" : "Not affected",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:7"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Not affected",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Not affected",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Not affected",
    "package_name" : "odh-dashboard-container",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "odh-operator-container",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "fix_state" : "Will not fix",
    "package_name" : "openshift3/ose-console",
    "cpe" : "cpe:/a:redhat:openshift:3.11"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-console",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-monitoring-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Will not fix",
    "package_name" : "openshift4/ose-networking-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat Openshift Container Storage 4",
    "fix_state" : "Affected",
    "package_name" : "ocs4/mcg-core-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_container_storage:4"
  }, {
    "product_name" : "Red Hat OpenShift Data Science (RHODS)",
    "fix_state" : "Fix deferred",
    "package_name" : "rhods/odh-dashboard-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_data_science"
  }, {
    "product_name" : "Red Hat OpenShift Data Science (RHODS)",
    "fix_state" : "Not affected",
    "package_name" : "rhods/odh-operator-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_data_science"
  }, {
    "product_name" : "Red Hat OpenShift Data Science (RHODS)",
    "fix_state" : "Not affected",
    "package_name" : "rhods/odh-rhel8-operator",
    "cpe" : "cpe:/a:redhat:openshift_data_science"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Affected",
    "package_name" : "devspaces/traefik-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Not affected",
    "package_name" : "rhosdt/jaeger-agent-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Not affected",
    "package_name" : "rhosdt/jaeger-collector-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Not affected",
    "package_name" : "rhosdt/jaeger-es-index-cleaner-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Not affected",
    "package_name" : "rhosdt/jaeger-es-rollover-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Not affected",
    "package_name" : "rhosdt/jaeger-ingester-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  }, {
    "product_name" : "Red Hat OpenShift distributed tracing 3",
    "fix_state" : "Affected",
    "package_name" : "rhosdt/jaeger-query-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_distributed_tracing:3"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Will not fix",
    "package_name" : "container-native-virtualization/kubevirt-console-plugin",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Will not fix",
    "package_name" : "container-native-virtualization/kubevirt-console-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat Process Automation 7",
    "fix_state" : "Will not fix",
    "package_name" : "serve-static",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Affected",
    "package_name" : "quay/quay-rhel8",
    "cpe" : "cpe:/a:redhat:quay:3"
  }, {
    "product_name" : "Red Hat Trusted Profile Analyzer",
    "fix_state" : "Affected",
    "package_name" : "rhtpa/rhtpa-trustification-service-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_profile_analyzer:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-43800\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-43800\nhttps://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b\nhttps://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa\nhttps://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p" ],
  "name" : "CVE-2024-43800",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}