{
  "threat_severity" : "Important",
  "public_date" : "2026-05-22T02:31:27Z",
  "bugzilla" : {
    "description" : "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
    "id" : "2480688",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-295",
  "details" : [ "Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.", "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities." ],
  "statement" : "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37072",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "podman-7:5.8.2-4.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:35833",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "container-tools:rhel8-8100020260701102925.afee755d"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37123",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "podman-6:5.8.2-4.el9_8"
  }, {
    "product_name" : "RHEM 1.0 for RHEL 9",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36796",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "flightctl-0:1.0.3-1.el9em"
  }, {
    "product_name" : "RHEM 1.1 for RHEL 10",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41019",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "flightctl-0:1.1.3-1.el10em"
  }, {
    "product_name" : "RHEM 1.1 for RHEL 9",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41019",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1:el9",
    "package" : "flightctl-0:1.1.3-1.el9em"
  }, {
    "product_name" : "DevWorkspace Operator 0.42",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36808",
    "cpe" : "cpe:/a:redhat:devworkspace:0.42::el9",
    "package" : "devworkspace/devworkspace-rhel9-operator:1782401674"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2.11",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41064",
    "cpe" : "cpe:/a:redhat:acm:2.11::el9",
    "package" : "rhacm2/multicluster-operators-subscription-rhel9:1783813250"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security 4.9",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26546",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.9::el8",
    "package" : "advanced-cluster-security/rhacs-main-rhel8:1781686446"
  }, {
    "product_name" : "Red Hat Advanced Cluster Security for Kubernetes 4.10",
    "release_date" : "2026-06-17T00:00:00Z",
    "advisory" : "RHSA-2026:26547",
    "cpe" : "cpe:/a:redhat:advanced_cluster_security:4.10::el8",
    "package" : "advanced-cluster-security/rhacs-main-rhel8:1781686458"
  }, {
    "product_name" : "Red Hat Edge Manager 1.0",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36651",
    "cpe" : "cpe:/a:redhat:edge_manager:1.0::el9",
    "package" : "rhem/flightctl-api-rhel9:1783502025"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:40945",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el10",
    "package" : "rhem/flightctl-api-rhel10:1784196588"
  }, {
    "product_name" : "Red Hat Edge Manager 1.1",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40118",
    "cpe" : "cpe:/a:redhat:edge_manager:1.1::el9",
    "package" : "rhem/flightctl-api-rhel9:1784126780"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-04T00:00:00Z",
    "advisory" : "RHSA-2026:23262",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "golang1-25-main-1.25.11-2.hum1"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "release_date" : "2026-06-04T00:00:00Z",
    "advisory" : "RHSA-2026:23264",
    "cpe" : "cpe:/a:redhat:hummingbird:1",
    "package" : "golang1-26-main-1.26.4-2.hum1"
  }, {
    "product_name" : "Red Hat OpenShift Builds 1.7.4",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36648",
    "cpe" : "cpe:/a:redhat:openshift_builds:1.7::el9",
    "package" : "openshift-builds/openshift-builds-waiters-rhel9:1783057868"
  }, {
    "product_name" : "Red Hat OpenShift Builds 1.8.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41036",
    "cpe" : "cpe:/a:redhat:openshift_builds:1.8::el9",
    "package" : "openshift-builds/openshift-builds-rhel9-operator:1784121108"
  }, {
    "product_name" : "Red Hat OpenShift Builds 1.8.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41036",
    "cpe" : "cpe:/a:redhat:openshift_builds:1.8::el9",
    "package" : "openshift-builds/openshift-builds-waiters-rhel9:1783612119"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/cephcsi-rhel9:1782932114"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/cephcsi-rhel9-operator:1782931768"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/devicefinder-rhel9:1782932104"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/mcg-core-rhel9:1783536000"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/mcg-rhel9-operator:1783535989"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-client-console-rhel9:1783536515"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-client-rhel9-operator:1782932521"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-metrics-exporter-rhel9:1783018461"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/ocs-rhel9-operator:1783018421"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-blackbox-exporter-rhel9:1782932812"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-cli-rhel9:1783537001"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-cloudnative-pg-rhel9-operator:1782932919"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-console-rhel9:1783537586"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-cosi-sidecar-rhel9:1782932969"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-csi-addons-rhel9-operator:1782933015"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-csi-addons-sidecar-rhel9:1782933042"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-drbd-rhel9:1783537392"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-external-snapshotter-rhel9-operator:1782933235"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-external-snapshotter-sidecar-rhel9:1782933251"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-multicluster-console-rhel9:1783537955"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-multicluster-rhel9-operator:1782933417"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-must-gather-rhel9:1783537742"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odf-rhel9-operator:1782933602"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odr-rhel9-operator:1783019377"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odr-volsync-plugin-mover-rhel9:1782934054"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/odr-volsync-plugin-rhel9-operator:1782934036"
  }, {
    "product_name" : "Red Hat Openshift Data Foundation 4.22",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37387",
    "cpe" : "cpe:/a:redhat:openshift_data_foundation:4.22::el9",
    "package" : "odf4/rook-ceph-rhel9-operator:1782934284"
  }, {
    "product_name" : "Red Hat Quay 3.1",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41031",
    "cpe" : "cpe:/a:redhat:quay:3.10::el8",
    "package" : "quay/quay-rhel8:1783750447"
  }, {
    "product_name" : "Red Hat Quay 3.12",
    "release_date" : "2026-07-20T00:00:00Z",
    "advisory" : "RHSA-2026:42146",
    "cpe" : "cpe:/a:redhat:quay:3.12::el8",
    "package" : "quay/quay-rhel8:1783751865"
  }, {
    "product_name" : "Red Hat Quay 3.15",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42796",
    "cpe" : "cpe:/a:redhat:quay:3.15::el8",
    "package" : "quay/quay-rhel8:1784351966"
  }, {
    "product_name" : "Red Hat Quay 3.16",
    "release_date" : "2026-07-16T00:00:00Z",
    "advisory" : "RHSA-2026:41066",
    "cpe" : "cpe:/a:redhat:quay:3.16::el9",
    "package" : "quay/quay-rhel9:1783955846"
  }, {
    "product_name" : "Red Hat Quay 3.9",
    "release_date" : "2026-07-15T00:00:00Z",
    "advisory" : "RHSA-2026:40262",
    "cpe" : "cpe:/a:redhat:quay:3.9::el8",
    "package" : "quay/quay-rhel8:1784125838"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.4",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36797",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.4::el9",
    "package" : "conforma-cli-stack-v1-4-1.4.2"
  }, {
    "product_name" : "Red Hat Trusted Artifact Signer 1.4",
    "release_date" : "2026-07-09T00:00:00Z",
    "advisory" : "RHSA-2026:37276",
    "cpe" : "cpe:/a:redhat:trusted_artifact_signer:1.4::el9",
    "package" : "conforma-cli-stack-v1-4-1.4.2"
  } ],
  "package_state" : [ {
    "product_name" : "Assisted Installer for Red Hat OpenShift Container Platform 2",
    "fix_state" : "Not affected",
    "package_name" : "assisted/agent-preinstall-image-builder-rhel9",
    "cpe" : "cpe:/a:redhat:assisted_installer:2"
  }, {
    "product_name" : "External Secrets Operator for Red Hat OpenShift",
    "fix_state" : "Will not fix",
    "package_name" : "external-secrets-operator/external-secrets-rhel9",
    "cpe" : "cpe:/a:redhat:external_secrets_operator:1"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Affected",
    "package_name" : "multicluster-engine/cluster-image-set-controller-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Under investigation",
    "package_name" : "multicluster-engine/hypershift-addon-rhel9-operator",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  }, {
    "product_name" : "OpenShift API for Data Protection",
    "fix_state" : "Affected",
    "package_name" : "oadp/oadp-mustgather-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1"
  }, {
    "product_name" : "OpenShift API for Data Protection",
    "fix_state" : "Under investigation",
    "package_name" : "oadp/oadp-velero-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_api_data_protection:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-1/kn-plugin-func-func-util-rhel9",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "OpenShift Serverless",
    "fix_state" : "Affected",
    "package_name" : "openshift-serverless-clients",
    "cpe" : "cpe:/a:redhat:serverless:1"
  }, {
    "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2",
    "fix_state" : "Affected",
    "package_name" : "rhacm2/volsync-rhel9",
    "cpe" : "cpe:/a:redhat:acm:2"
  }, {
    "product_name" : "Red Hat Ceph Storage 9",
    "fix_state" : "Affected",
    "package_name" : "rhceph/alloy-rhel10",
    "cpe" : "cpe:/a:redhat:ceph_storage:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "golang",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "gvisor-tap-vsock",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "golang",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "golang",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "gvisor-tap-vsock",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Affected",
    "package_name" : "golang",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift AI (RHOAI)",
    "fix_state" : "Affected",
    "package_name" : "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_ai"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "cri-o",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "microshift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Under investigation",
    "package_name" : "openshift4/ose-hypershift-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-tests",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-tests-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "ose-azure-acr-image-credential-provider",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "podman",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-rhel8",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift GitOps",
    "fix_state" : "Affected",
    "package_name" : "openshift-gitops-1/argocd-rhel9",
    "cpe" : "cpe:/a:redhat:openshift_gitops:1"
  }, {
    "product_name" : "Red Hat OpenShift Virtualization 4",
    "fix_state" : "Affected",
    "package_name" : "kubevirt",
    "cpe" : "cpe:/a:redhat:container_native_virtualization:4"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Not affected",
    "package_name" : "golang-googlecode-go-crypto",
    "cpe" : "cpe:/a:redhat:openstack:16.2"
  }, {
    "product_name" : "Red Hat OpenStack Platform 16.2",
    "fix_state" : "Not affected",
    "package_name" : "rhosp-rhel8/osp-director-agent",
    "cpe" : "cpe:/a:redhat:openstack:16.2"
  }, {
    "product_name" : "Red Hat OpenStack Platform 17.1",
    "fix_state" : "Not affected",
    "package_name" : "rhosp-rhel9/osp-director-agent",
    "cpe" : "cpe:/a:redhat:openstack:17.1"
  }, {
    "product_name" : "Red Hat OpenStack Platform 18.0",
    "fix_state" : "Not affected",
    "package_name" : "rhoso-operators/prometheus-podman-exporter-rhel9",
    "cpe" : "cpe:/a:redhat:openstack:18.0"
  }, {
    "product_name" : "Red Hat Quay 3",
    "fix_state" : "Affected",
    "package_name" : "quay/quay-builder-rhel9",
    "cpe" : "cpe:/a:redhat:quay:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-42508\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42508\nhttps://go.dev/cl/781220\nhttps://go.dev/issue/79568\nhttps://groups.google.com/g/golang-announce/c/a082jnz-LvI\nhttps://pkg.go.dev/vuln/GO-2026-5021" ],
  "name" : "CVE-2026-42508",
  "csaw" : false
}