{
  "threat_severity" : "Important",
  "public_date" : "2026-08-07T16:37:40Z",
  "bugzilla" : {
    "description" : "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution",
    "id" : "2512562",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.1",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-59",
  "details" : [ "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.", "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification." ],
  "statement" : "go-git is a pure-Go implementation of Git. During worktree operations (checkout, status, add), go-git resolves symbolic links without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause a consuming application to read from or write to files outside the intended working directory when that repository is cloned and its worktree operations are used. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed. Red Hat rates the impact of this flaw as Important.",
  "affected_release" : [ {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-08-27T00:00:00Z",
    "advisory" : "RHSA-2026:60646",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "syft-main-1.51.1-0.1.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-08-28T00:00:00Z",
    "advisory" : "RHSA-2026:60793",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "grype-main-0.118.0-0.1.hum1"
  } ],
  "package_state" : [ {
    "product_name" : "Assisted Installer for Red Hat OpenShift Container Platform 2",
    "fix_state" : "Affected",
    "package_name" : "assisted/agent-preinstall-image-builder-rhel9",
    "cpe" : "cpe:/a:redhat:assisted_installer:2"
  }, {
    "product_name" : "Assisted Installer for Red Hat OpenShift Container Platform 2",
    "fix_state" : "Affected",
    "package_name" : "rhai/assisted-installer-controller-rhel9",
    "cpe" : "cpe:/a:redhat:assisted_installer:2"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-builds/openshift-builds-controller-rhel10",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-builds/openshift-builds-controller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-builds/openshift-builds-git-cloner-rhel10",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-builds/openshift-builds-git-cloner-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-builds/openshift-builds-image-bundler-rhel10",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-builds/openshift-builds-image-bundler-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-builds/openshift-builds-image-processing-rhel10",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-builds/openshift-builds-image-processing-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-builds/openshift-builds-waiters-rhel10",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-builds/openshift-builds-waiters-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Not affected",
    "package_name" : "openshift-builds/openshift-builds-webhook-rhel10",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Builds for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-builds/openshift-builds-webhook-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_builds:1"
  }, {
    "product_name" : "Compliance Operator",
    "fix_state" : "Affected",
    "package_name" : "compliance/openshift-compliance-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_compliance_operator:1"
  }, {
    "product_name" : "Confidential Compute Attestation",
    "fix_state" : "Affected",
    "package_name" : "build-of-trustee/trustee-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1"
  }, {
    "product_name" : "Confidential Compute Attestation",
    "fix_state" : "Affected",
    "package_name" : "openshift-sandboxed-containers/osc-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1"
  }, {
    "product_name" : "Confidential Compute Attestation",
    "fix_state" : "Affected",
    "package_name" : "openshift-sandboxed-containers/osc-podvm-builder-rhel9",
    "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1"
  }, {
    "product_name" : "Custom Metric Autoscaler operator for Red Hat Openshift",
    "fix_state" : "Affected",
    "package_name" : "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
  }, {
    "product_name" : "DPU kit for NVIDIA",
    "fix_state" : "Affected",
    "package_name" : "dpu-kit-for-nvidia/must-gather-rhel10",
    "cpe" : "cpe:/a:redhat:dpu_kit:4"
  }, {
    "product_name" : "Exploit Intelligence",
    "fix_state" : "Affected",
    "package_name" : "exploit-intelligence/agent-client-rhel9",
    "cpe" : "cpe:/a:redhat:exploit_intelligence:0"
  }, {
    "product_name" : "Exploit Intelligence",
    "fix_state" : "Affected",
    "package_name" : "exploit-intelligence-tech-preview/agent-client-rhel9",
    "cpe" : "cpe:/a:redhat:exploit_intelligence:0"
  }, {
    "product_name" : "Exploit Intelligence",
    "fix_state" : "Affected",
    "package_name" : "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9",
    "cpe" : "cpe:/a:redhat:exploit_intelligence:0"
  }, {
    "product_name" : "External Secrets Operator for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "external-secrets-operator/external-secrets-rhel9",
    "cpe" : "cpe:/a:redhat:external_secrets_operator:1"
  }, {
    "product_name" : "Kernel Module Management Operator for Red Hat Openshift",
    "fix_state" : "Affected",
    "package_name" : "kmm/kernel-module-management-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:kernel_module_management:2"
  }, {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-logging/cluster-logging-rhel9-operator",
    "cpe" : "cpe:/a:redhat:logging:6"
  }, {
    "product_name" : "Logical Volume Manager Storage",
    "fix_state" : "Affected",
    "package_name" : "lvms4/lvms-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:lvms:4"
  }, {
    "product_name" : "Logical Volume Manager Storage",
    "fix_state" : "Affected",
    "package_name" : "lvms4/lvms-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:lvms:4"
  }, {
    "product_name" : "Machine Deletion Remediation Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/machine-deletion-remediation-operator-bundle",
    "cpe" : "cpe:/a:redhat:workload_availability_mdr:0"
  }, {
    "product_name" : "Machine Deletion Remediation Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/machine-deletion-remediation-rhel9-operator",
    "cpe" : "cpe:/a:redhat:workload_availability_mdr:0"
  }, {
    "product_name" : "Migration Toolkit for Containers",
    "fix_state" : "Affected",
    "package_name" : "rhmtc/openshift-migration-log-reader-rhel8",
    "cpe" : "cpe:/a:redhat:rhmt:1"
  }, {
    "product_name" : "Migration Toolkit for Containers",
    "fix_state" : "Affected",
    "package_name" : "rhmtc/openshift-migration-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:rhmt:1"
  }, {
    "product_name" : "Migration Toolkit for Virtualization",
    "fix_state" : "Affected",
    "package_name" : "migration-toolkit-virtualization/mtv-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2"
  }, {
    "product_name" : "Migration Toolkit for Virtualization",
    "fix_state" : "Affected",
    "package_name" : "migration-toolkit-virtualization/mtv-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-installer-controller-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-installer-controller-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-service-8-rhel8",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/assisted-service-9-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/cluster-image-set-controller-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-healthcheck-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "Node HealthCheck Operator",
    "fix_state" : "Affected",
    "package_name" : "workload-availability/node-healthcheck-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:workload_availability_nhc:0"
  }, {
    "product_name" : "OpenShift API for Data Protection",
    "fix_state" : "Affected",
    "package_name" : "oadp/oadp-mustgather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1"
  }, {
    "product_name" : "OpenShift Developer Tools and Services",
    "fix_state" : "Affected",
    "package_name" : "ocp-tools-4/jenkins-agent-base-rhel8",
    "cpe" : "cpe:/a:redhat:ocp_tools"
  }, {
    "product_name" : "OpenShift Developer Tools and Services",
    "fix_state" : "Affected",
    "package_name" : "ocp-tools-4/jenkins-agent-base-rhel9",
    "cpe" : "cpe:/a:redhat:ocp_tools"
  }, {
    "product_name" : "OpenShift Developer Tools and Services",
    "fix_state" : "Affected",
    "package_name" : "ocp-tools-4/jenkins-rhel8",
    "cpe" : "cpe:/a:redhat:ocp_tools"
  }, {
    "product_name" : "OpenShift Developer Tools and Services",
    "fix_state" : "Affected",
    "package_name" : "ocp-tools-4/jenkins-rhel9",
    "cpe" : "cpe:/a:redhat:ocp_tools"
  }, {
    "product_name" : "OpenShift Lightspeed",
    "fix_state" : "Affected",
    "package_name" : "openshift-lightspeed/lightspeed-agentic-sandbox-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_lightspeed"
  }, {
    "product_name" : "OpenShift Pipelines",
    "fix_state" : "Affected",
    "package_name" : "openshift-pipelines/pipelines-resolvers-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_pipelines:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-1/kn-client-kn-rhel9",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-1/kn-plugin-func-func-util-rhel9",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-1/serverless-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-clients",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Service Mesh 3",
    "fix_state" : "Affected",
    "package_name" : "openshift-service-mesh/istio-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:service_mesh:3"
  }, {
    "product_name" : "Pen Drive Powered by Red Hat Lightspeed",
    "fix_state" : "Affected",
    "package_name" : "pen-drive/pen-drive-scanner-rhel9",
    "cpe" : "cpe:/a:redhat:pdrive_lightspeed:1"
  }, {
    "product_name" : "Power monitoring for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-power-monitoring/power-monitoring-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_power_monitoring"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "flightctl",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/acm-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/kube-state-metrics-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/multicluster-operators-subscription-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/submariner-operator-bundle",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/submariner-rhel9-operator",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-main-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-main-rhel9",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-operator-bundle",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-rhel8-operator",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-rhel9-operator",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-roxctl-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-roxctl-rhel9",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-rhel9",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-slim-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-slim-rhel9",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-v4-rhel8",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4",
    "fix_state" : "Not affected",
    "package_name" : "advanced-cluster-security/rhacs-scanner-v4-rhel9",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4"
  }, {
    "product_name" : "Red Hat AI Inference Server",
    "fix_state" : "Affected",
    "package_name" : "rhaiis/vllm-cpu-rhel9",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3"
  }, {
    "product_name" : "Red Hat AI Inference Server",
    "fix_state" : "Affected",
    "package_name" : "rhaiis/vllm-tpu-rhel9",
    "cpe" : "cpe:/a:redhat:ai_inference_server:3"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-24/aap-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "ansible-automation-platform-24/ee-supported-rhel8",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "ansible-automation-platform-24/ee-supported-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-25/aap-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-25/ee-supported-rhel8",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-25/ee-supported-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-26/aap-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-26/ee-supported-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-26/platform-resource-runner-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-27/aap-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-27/ansible-devspaces-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-27/ee-supported-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-27/platform-resource-runner-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Ansible Automation Platform 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform-tech-preview/ansible-devspaces-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_automation_platform:2"
  }, {
    "product_name" : "Red Hat Build of Kueue",
    "fix_state" : "Not affected",
    "package_name" : "kueue/kueue-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:kueue_operator:1"
  }, {
    "product_name" : "Red Hat Ceph Storage 9",
    "fix_state" : "Affected",
    "package_name" : "rhceph/alloy-rhel10",
    "cpe" : "cpe:/a:redhat:ceph_storage:9"
  }, {
    "product_name" : "Red Hat Certification Program for Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "rhcertification/redhat-certification-baremetal",
    "cpe" : "cpe:/a:redhat:certifications:9"
  }, {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Affected",
    "package_name" : "rhdh/rhdh-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "flightctl",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-alert-exporter-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-alert-exporter-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-alertmanager-proxy-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-alertmanager-proxy-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-api-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-api-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-cli-artifacts-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-cli-artifacts-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-db-setup-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-db-setup-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-imagebuilder-api-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-imagebuilder-api-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-imagebuilder-worker-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-imagebuilder-worker-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-pam-issuer-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-pam-issuer-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-periodic-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-periodic-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-telemetry-gateway-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-telemetry-gateway-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-userinfo-proxy-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-userinfo-proxy-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-worker-rhel10",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Edge Manager 1",
    "fix_state" : "Affected",
    "package_name" : "rhem/flightctl-worker-rhel9",
    "cpe" : "cpe:/a:redhat:edge_manager:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "grafana",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "kube-state-metrics",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Affected",
    "package_name" : "trivy",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-ai-gateway-payload-processing-e2e-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-th06-cpu-torch291-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/rhai-cli-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "cri-o",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/cnf-tests-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/cnf-tests-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/kube-compare-artifacts-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/lifecycle-agent-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/microshift-bootc-rhel10",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/microshift-bootc-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/network-tools-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/network-tools-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/numaresources-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/o-cloud-manager-operator-bundle",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/o-cloud-manager-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/oc-mirror-plugin-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/oc-mirror-plugin-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-api-server-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-api-server-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-csr-approver-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-agent-installer-csr-approver-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-ansible-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-baremetal-installer-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-cli",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-cli-artifacts",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-cli-artifacts-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-cli-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-console",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-console-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-csi-driver-shared-resource-mustgather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-csi-driver-shared-resource-mustgather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-deployer",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-deployer-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-cni-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-daemon-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-intel-netsec-vsp-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-marvell-cp-agent-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-marvell-vsp-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-network-resources-injector-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-dpu-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-helm-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-helm-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-kube-state-metrics-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-local-storage-mustgather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-local-storage-mustgather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-machine-os-images-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-must-gather",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-olm-catalogd-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-olm-catalogd-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-olm-operator-controller-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-olm-operator-controller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-olm-rukpak-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-olm-rukpak-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-operator-framework-tools-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-operator-lifecycle-manager",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-operator-lifecycle-manager-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-operator-registry",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-operator-registry-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-operator-sdk-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-operator-sdk-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-ovn-kubernetes",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-ovn-kubernetes-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-sdn-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-secrets-store-csi-mustgather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-secrets-store-csi-mustgather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-tests",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-tests-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-tools-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ose-tools-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ptp-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift4/ptp-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift-clients",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift-kni/commatrix",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "ose-azure-acr-image-credential-provider",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Affected",
    "package_name" : "odf4/mcg-core-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Affected",
    "package_name" : "odf4/odf-multicluster-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4",
    "fix_state" : "Affected",
    "package_name" : "odf4/odf-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4"
  }, {
    "product_name" : "Red Hat OpenShift Dev Spaces",
    "fix_state" : "Affected",
    "package_name" : "devspaces/udi-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_devspaces:3"
  }, {
    "product_name" : "Red Hat OpenShift Dev Workspaces Operator",
    "fix_state" : "Affected",
    "package_name" : "devworkspace/devworkspace-operator-bundle",
    "cpe" : "cpe:/a:redhat:devworkspace"
  }, {
    "product_name" : "Red Hat OpenShift Dev Workspaces Operator",
    "fix_state" : "Affected",
    "package_name" : "devworkspace/devworkspace-project-clone-rhel9",
    "cpe" : "cpe:/a:redhat:devworkspace"
  }, {
    "product_name" : "Red Hat OpenShift Dev Workspaces Operator",
    "fix_state" : "Affected",
    "package_name" : "devworkspace/devworkspace-rhel9-operator",
    "cpe" : "cpe:/a:redhat:devworkspace"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "microshift-gitops",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-agent-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-agent-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-image-updater-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-image-updater-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/gitops-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/gitops-rhel8-operator",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/gitops-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/gitops-rhel9-operator",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-argocd-cli",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "container-native-virtualization/cluster-network-addons-operator",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "container-native-virtualization/cluster-network-addons-operator-rhel9",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "container-native-virtualization/cnv-must-gather-rhel8",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "container-native-virtualization/cnv-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "container-native-virtualization/ocp-virt-validation-checkup-rhel9",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Affected",
    "package_name" : "rhosp-rhel8/osp-director-agent",
    "cpe" : "cpe:/a:redhat:openstack:16.2"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Affected",
    "package_name" : "rhosp-rhel8/osp-director-operator",
    "cpe" : "cpe:/a:redhat:openstack:16.2"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Not affected",
    "package_name" : "rhosp-rhel8/osp-director-operator-bundle",
    "cpe" : "cpe:/a:redhat:openstack:16.2"
  }, {
    "product_name" : "Red Hat OpenStack Platform 17.1",
    "fix_state" : "Affected",
    "package_name" : "rhosp-rhel9/osp-director-agent",
    "cpe" : "cpe:/a:redhat:openstack:17.1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 17.1",
    "fix_state" : "Affected",
    "package_name" : "rhosp-rhel9/osp-director-operator",
    "cpe" : "cpe:/a:redhat:openstack:17.1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 17.1",
    "fix_state" : "Not affected",
    "package_name" : "rhosp-rhel9/osp-director-operator-bundle",
    "cpe" : "cpe:/a:redhat:openstack:17.1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 18.0",
    "fix_state" : "Affected",
    "package_name" : "rhoso-operators/openstack-must-gather-rhel9",
    "cpe" : "cpe:/a:redhat:openstack:18.0"
  }, {
    "product_name" : "Red Hat OpenStack Platform 18.0",
    "fix_state" : "Not affected",
    "package_name" : "rhoso-operators/openstack-operator-bundle",
    "cpe" : "cpe:/a:redhat:openstack:18.0"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer",
    "fix_state" : "Not affected",
    "package_name" : "rhtas/ec-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer",
    "fix_state" : "Affected",
    "package_name" : "rhtas/gitsign-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1"
  }, {
    "product_name" : "Red Hat Web Terminal",
    "fix_state" : "Affected",
    "package_name" : "web-terminal/web-terminal-tooling-rhel9",
    "cpe" : "cpe:/a:redhat:webterminal:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-71556\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71556\nhttps://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab\nhttps://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac\nhttps://github.com/go-git/go-git/releases/tag/v5.19.2\nhttps://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5\nhttps://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm" ],
  "name" : "CVE-2026-71556",
  "mitigation" : {
    "value" : "To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).",
    "lang" : "en:us"
  },
  "csaw" : false
}