{ "threat_severity" : "Moderate", "public_date" : "2026-01-22T22:05:08Z", "bugzilla" : { "description" : "github.com/sigstore/rekor: Rekor Server-Side Request Forgery (SSRF)", "id" : "2432218", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2432218" }, "cvss3" : { "cvss3_base_score" : "5.3", "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status" : "verified" }, "cwe" : "CWE-918", "details" : [ "Rekor is a software supply chain transparency log. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. The issue has been fixed in version 1.5.0. To workaround this issue, disable the search endpoint with --enable_retrieve_api=false.", "A Server-Side Request Forgery (SSRF) flaw has been discovered in the Rekor transparency log tool. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF." ], "affected_release" : [ { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/cephcsi-rhel9:1782932114" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/cephcsi-rhel9-operator:1782931768" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/devicefinder-rhel9:1782932104" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/mcg-core-rhel9:1783536000" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/mcg-rhel9-operator:1783535989" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/ocs-client-console-rhel9:1783536515" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/ocs-client-rhel9-operator:1782932521" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/ocs-metrics-exporter-rhel9:1783018461" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/ocs-rhel9-operator:1783018421" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-blackbox-exporter-rhel9:1782932812" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-cli-rhel9:1783537001" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-cloudnative-pg-rhel9-operator:1782932919" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-console-rhel9:1783537586" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-cosi-sidecar-rhel9:1782932969" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-csi-addons-rhel9-operator:1782933015" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-csi-addons-sidecar-rhel9:1782933042" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-drbd-rhel9:1783537392" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-external-snapshotter-rhel9-operator:1782933235" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-external-snapshotter-sidecar-rhel9:1782933251" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-multicluster-console-rhel9:1783537955" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-multicluster-rhel9-operator:1782933417" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-must-gather-rhel9:1783537742" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odf-rhel9-operator:1782933602" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odr-rhel9-operator:1783019377" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odr-volsync-plugin-mover-rhel9:1782934054" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/odr-volsync-plugin-rhel9-operator:1782934036" }, { "product_name" : "Red Hat Openshift Data Foundation 4.22", "release_date" : "2026-07-09T00:00:00Z", "advisory" : "RHSA-2026:37387", "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9", "package" : "odf4/rook-ceph-rhel9-operator:1782934284" } ], "package_state" : [ { "product_name" : "Assisted Installer for Red Hat OpenShift Container Platform 2", "fix_state" : "Fix deferred", "package_name" : "assisted/agent-preinstall-image-builder-rhel9", "cpe" : "cpe:/a:redhat:assisted_installer:2" }, { "product_name" : "Confidential Compute Attestation", "fix_state" : "Fix deferred", "package_name" : "openshift-sandboxed-containers/osc-must-gather-rhel9", "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1" }, { "product_name" : "Kernel Module Management Operator for Red Hat Openshift", "fix_state" : "Fix deferred", "package_name" : "kmm/kernel-module-management-must-gather-rhel9", "cpe" : "cpe:/a:redhat:kernel_module_management:2" }, { "product_name" : "Logging Subsystem for Red Hat OpenShift", "fix_state" : "Fix deferred", "package_name" : "openshift-logging/cluster-logging-rhel9-operator", "cpe" : "cpe:/a:redhat:logging:5" }, { "product_name" : "Logging Subsystem for Red Hat OpenShift", "fix_state" : "Fix deferred", "package_name" : "openshift-logging/cluster-logging-rhel9-operator", "cpe" : "cpe:/a:redhat:logging:6" }, { "product_name" : "Migration Toolkit for Containers", "fix_state" : "Fix deferred", "package_name" : "rhmtc/openshift-migration-controller-rhel8", "cpe" : "cpe:/a:redhat:rhmt:1" }, { "product_name" : "Migration Toolkit for Containers", "fix_state" : "Fix deferred", "package_name" : "rhmtc/openshift-migration-log-reader-rhel8", "cpe" : "cpe:/a:redhat:rhmt:1" }, { "product_name" : "Migration Toolkit for Containers", "fix_state" : "Fix deferred", "package_name" : "rhmtc/openshift-migration-must-gather-rhel8", "cpe" : "cpe:/a:redhat:rhmt:1" }, { "product_name" : "Migration Toolkit for Virtualization", "fix_state" : "Fix deferred", "package_name" : "migration-toolkit-virtualization/mtv-must-gather-rhel8", "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2" }, { "product_name" : "Migration Toolkit for Virtualization", "fix_state" : "Fix deferred", "package_name" : "mtv-candidate/mtv-must-gather-rhel8", "cpe" : "cpe:/a:redhat:migration_toolkit_virtualization:2" }, { "product_name" : "Multiarch Tuning Operator", "fix_state" : "Fix deferred", "package_name" : "multiarch-tuning/multiarch-tuning-operator-bundle", "cpe" : "cpe:/a:redhat:multiarch_tuning_operator" }, { "product_name" : "Multiarch Tuning Operator", "fix_state" : "Fix deferred", "package_name" : "multiarch-tuning/multiarch-tuning-rhel9-operator", "cpe" : "cpe:/a:redhat:multiarch_tuning_operator" }, { "product_name" : "Multicluster Engine for Kubernetes", "fix_state" : "Fix deferred", "package_name" : "multicluster-engine/must-gather-rhel9", "cpe" : "cpe:/a:redhat:multicluster_engine" }, { "product_name" : "Network Observability Operator", "fix_state" : "Fix deferred", "package_name" : "network-observability/network-observability-cli-rhel9", "cpe" : "cpe:/a:redhat:network_observ_optr:1" }, { "product_name" : "Node HealthCheck Operator", "fix_state" : "Fix deferred", "package_name" : "workload-availability/node-healthcheck-must-gather-rhel9", "cpe" : "cpe:/a:redhat:workload_availability_nhc:0" }, { "product_name" : "OpenShift API for Data Protection", "fix_state" : "Fix deferred", "package_name" : "oadp/oadp-mustgather-rhel9", "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1" }, { "product_name" : "OpenShift API for Data Protection", "fix_state" : "Fix deferred", "package_name" : "oadp/oadp-velero-plugin-rhel8", "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1" }, { "product_name" : "OpenShift API for Data Protection", "fix_state" : "Fix deferred", "package_name" : "oadp/oadp-velero-plugin-rhel9", "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1" }, { "product_name" : "OpenShift Developer Tools and Services", "fix_state" : "Fix deferred", "package_name" : "ocp-tools-4/jenkins-agent-base-rhel8", "cpe" : "cpe:/a:redhat:ocp_tools" }, { "product_name" : "OpenShift Developer Tools and Services", "fix_state" : "Fix deferred", "package_name" : "ocp-tools-4/jenkins-agent-base-rhel9", "cpe" : "cpe:/a:redhat:ocp_tools" }, { "product_name" : "OpenShift Developer Tools and Services", "fix_state" : "Fix deferred", "package_name" : "ocp-tools-4/jenkins-rhel8", "cpe" : "cpe:/a:redhat:ocp_tools" }, { "product_name" : "OpenShift Developer Tools and Services", "fix_state" : "Fix deferred", "package_name" : "ocp-tools-4/jenkins-rhel9", "cpe" : "cpe:/a:redhat:ocp_tools" }, { "product_name" : "OpenShift Developer Tools and Services", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-jenkins", "cpe" : "cpe:/a:redhat:ocp_tools" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-chains-controller-rhel8", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-chains-controller-rhel9", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-cli-tkn-rhel8", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-cli-tkn-rhel9", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-opc-rhel9", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-operator-bundle", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-operator-proxy-rhel8", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-operator-webhook-rhel8", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-rhel8-operator", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Fix deferred", "package_name" : "openshift-pipelines/pipelines-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Serverless", "fix_state" : "Fix deferred", "package_name" : "openshift-serverless-1/kn-plugin-event-sender-rhel9", "cpe" : "cpe:/a:redhat:serverless:1" }, { "product_name" : "OpenShift Serverless", "fix_state" : "Fix deferred", "package_name" : "openshift-serverless-1/serverless-must-gather-rhel9", "cpe" : "cpe:/a:redhat:serverless:1" }, { "product_name" : "OpenShift Service Mesh 2", "fix_state" : "Fix deferred", "package_name" : "openshift-service-mesh/istio-must-gather-rhel9", "cpe" : "cpe:/a:redhat:service_mesh:2" }, { "product_name" : "OpenShift Service Mesh 3", "fix_state" : "Fix deferred", "package_name" : "openshift-service-mesh/istio-must-gather-rhel9", "cpe" : "cpe:/a:redhat:service_mesh:3" }, { "product_name" : "Pen Drive Powered by Red Hat Lightspeed", "fix_state" : "Fix deferred", "package_name" : "pen-drive/pen-drive-scanner-rhel9", "cpe" : "cpe:/a:redhat:pdrive_lightspeed:0" }, { "product_name" : "Power monitoring for Red Hat OpenShift", "fix_state" : "Fix deferred", "package_name" : "openshift-power-monitoring/power-monitoring-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift_power_monitoring" }, { "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2", "fix_state" : "Fix deferred", "package_name" : "rhacm2/acm-must-gather-rhel9", "cpe" : "cpe:/a:redhat:acm:2" }, { "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2", "fix_state" : "Fix deferred", "package_name" : "rhacm2/submariner-operator-bundle", "cpe" : "cpe:/a:redhat:acm:2" }, { "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2", "fix_state" : "Fix deferred", "package_name" : "rhacm2/submariner-rhel9-operator", "cpe" : "cpe:/a:redhat:acm:2" }, { "product_name" : "Red Hat Advanced Cluster Security 4", "fix_state" : "Fix deferred", "package_name" : "advanced-cluster-security/rhacs-central-db-rhel8", "cpe" : "cpe:/a:redhat:advanced_cluster_security:4" }, { "product_name" : "Red Hat Advanced Cluster Security 4", "fix_state" : "Fix deferred", "package_name" : "advanced-cluster-security/rhacs-main-rhel8", "cpe" : "cpe:/a:redhat:advanced_cluster_security:4" }, { "product_name" : "Red Hat Advanced Cluster Security 4", "fix_state" : "Fix deferred", "package_name" : "advanced-cluster-security/rhacs-rhel8-operator", "cpe" : "cpe:/a:redhat:advanced_cluster_security:4" }, { "product_name" : "Red Hat Advanced Cluster Security 4", "fix_state" : "Fix deferred", "package_name" : "advanced-cluster-security/rhacs-roxctl-rhel8", "cpe" : "cpe:/a:redhat:advanced_cluster_security:4" }, { "product_name" : "Red Hat Advanced Cluster Security 4", "fix_state" : "Fix deferred", "package_name" : "advanced-cluster-security/rhacs-scanner-v4-db-rhel8", "cpe" : "cpe:/a:redhat:advanced_cluster_security:4" }, { "product_name" : "Red Hat Advanced Cluster Security 4", "fix_state" : "Fix deferred", "package_name" : "advanced-cluster-security/rhacs-scanner-v4-rhel8", "cpe" : "cpe:/a:redhat:advanced_cluster_security:4" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-25/aap-must-gather-rhel8", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Ansible Automation Platform 2", "fix_state" : "Fix deferred", "package_name" : "ansible-automation-platform-26/aap-must-gather-rhel9", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2" }, { "product_name" : "Red Hat Build of Kueue", "fix_state" : "Fix deferred", "package_name" : "kueue/kueue-must-gather-rhel9", "cpe" : "cpe:/a:redhat:kueue_operator:1" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Fix deferred", "package_name" : "buildah", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Fix deferred", "package_name" : "podman", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Fix deferred", "package_name" : "skopeo", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Fix deferred", "package_name" : "rhel9/bootc-image-builder", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-must-gather-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Fix deferred", "package_name" : "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/cnf-tests-rhel8", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/cnf-tests-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/kube-compare-artifacts-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/lifecycle-agent-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/network-tools-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/numaresources-must-gather-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/oc-mirror-plugin-rhel8", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/oc-mirror-plugin-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-cli", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-cli-artifacts", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-cli-artifacts-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-cli-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-csi-driver-shared-resource-mustgather-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-deployer", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-deployer-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-docker-builder", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-docker-builder-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-helm-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-local-storage-mustgather-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-machine-config-operator", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-machine-config-rhel9-operator", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-machine-os-images-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-must-gather-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-olm-catalogd-rhel8", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-olm-catalogd-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-olm-operator-controller-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-openshift-controller-manager-rhel8", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-openshift-controller-manager-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-secrets-store-csi-mustgather-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-tests-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-tools-rhel8", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ose-tools-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Fix deferred", "package_name" : "openshift4/ptp-must-gather-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift GitOps", "fix_state" : "Fix deferred", "package_name" : "openshift-gitops-1/must-gather-rhel8", "cpe" : "cpe:/a:redhat:openshift_gitops:1" }, { "product_name" : "Red Hat OpenStack Platform 18.0", "fix_state" : "Fix deferred", "package_name" : "rhoso-operators/prometheus-podman-exporter-rhel9", "cpe" : "cpe:/a:redhat:openstack:18.0" }, { "product_name" : "Red Hat Quay 3", "fix_state" : "Fix deferred", "package_name" : "quay/quay-builder-rhel8", "cpe" : "cpe:/a:redhat:quay:3" }, { "product_name" : "Red Hat Quay 3", "fix_state" : "Fix deferred", "package_name" : "quay/quay-builder-rhel9", "cpe" : "cpe:/a:redhat:quay:3" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/client-server-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/cosign-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/gitsign-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/policy-controller-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/rekor-backfill-redis-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/rekor-monitor-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/rekor-server-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Red Hat Trusted Artifact Signer", "fix_state" : "Fix deferred", "package_name" : "rhtas/rhtas-console-rhel9", "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1" }, { "product_name" : "Security Profiles Operator", "fix_state" : "Fix deferred", "package_name" : "compliance/openshift-security-profiles-operator-bundle", "cpe" : "cpe:/a:redhat:openshift_security_profiles_operator:1" }, { "product_name" : "Security Profiles Operator", "fix_state" : "Fix deferred", "package_name" : "compliance/openshift-security-profiles-rhel8-operator", "cpe" : "cpe:/a:redhat:openshift_security_profiles_operator:1" }, { "product_name" : "Zero Trust Workload Identity Manager", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:1" }, { "product_name" : "Zero Trust Workload Identity Manager", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:1" }, { "product_name" : "Zero Trust Workload Identity Manager", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/spiffe-spire-server-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:1" }, { "product_name" : "Zero Trust Workload Identity Manager - Tech Preview", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:0" }, { "product_name" : "Zero Trust Workload Identity Manager - Tech Preview", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:0" }, { "product_name" : "Zero Trust Workload Identity Manager - Tech Preview", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/spiffe-spire-server-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:0" }, { "product_name" : "Zero Trust Workload Identity Manager - Tech Preview", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-operator-bundle", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:0" }, { "product_name" : "Zero Trust Workload Identity Manager - Tech Preview", "fix_state" : "Fix deferred", "package_name" : "zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9", "cpe" : "cpe:/a:redhat:zero_trust_workload_identity_manager:0" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-24117\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24117\nhttps://github.com/sigstore/rekor/commit/60ef2bceba192c5bf9327d003bceea8bf1f8275f\nhttps://github.com/sigstore/rekor/releases/tag/v1.5.0\nhttps://github.com/sigstore/rekor/security/advisories/GHSA-4c4x-jm2x-pf9j" ], "name" : "CVE-2026-24117", "mitigation" : { "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "lang" : "en:us" }, "csaw" : false }