{ "document" : { "aggregate_severity" : { "namespace" : "https://access.redhat.com/security/updates/classification/", "text" : "Critical" }, "category" : "csaf_security_advisory", "csaf_version" : "2.0", "distribution" : { "text" : "Copyright © Red Hat, Inc. All rights reserved.", "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "en", "notes" : [ { "category" : "summary", "text" : "Cost Management Metrics Operator version 4.5.1 release.", "title" : "Topic" }, { "category" : "general", "text" : "The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift.\nThe operator runs on the latest supported versions of Openshift.\nThis operator obtains OpenShift usage data by querying Prometheus every hour to create metric reports\nthat it uploads to Cost Management at console.redhat.com.", "title" : "Details" }, { "category" : "legal_disclaimer", "text" : "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title" : "Terms of Use" } ], "publisher" : { "category" : "vendor", "contact_details" : "https://access.redhat.com/security/team/contact/", "issuing_authority" : "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name" : "Red Hat Product Security", "namespace" : "https://www.redhat.com" }, "references" : [ { "category" : "self", "summary" : "https://access.redhat.com/errata/RHSA-2026:95264", "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-103111", "url" : "https://access.redhat.com/security/cve/CVE-2026-103111" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-114406", "url" : "https://access.redhat.com/security/cve/CVE-2026-114406" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-18374", "url" : "https://access.redhat.com/security/cve/CVE-2026-18374" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-19542", "url" : "https://access.redhat.com/security/cve/CVE-2026-19542" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-6368", "url" : "https://access.redhat.com/security/cve/CVE-2026-6368" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-6791", "url" : "https://access.redhat.com/security/cve/CVE-2026-6791" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-77117", "url" : "https://access.redhat.com/security/cve/CVE-2026-77117" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-80489", "url" : "https://access.redhat.com/security/cve/CVE-2026-80489" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-84782", "url" : "https://access.redhat.com/security/cve/CVE-2026-84782" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-86145", "url" : "https://access.redhat.com/security/cve/CVE-2026-86145" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-89157", "url" : "https://access.redhat.com/security/cve/CVE-2026-89157" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-89158", "url" : "https://access.redhat.com/security/cve/CVE-2026-89158" }, { "category" : "external", "summary" : "https://access.redhat.com/security/cve/CVE-2026-89161", "url" : "https://access.redhat.com/security/cve/CVE-2026-89161" }, { "category" : "external", "summary" : "https://access.redhat.com/security/updates/classification", "url" : "https://access.redhat.com/security/updates/classification" }, { "category" : "external", "summary" : "https://access.redhat.com/security/updates/classification/", "url" : "https://access.redhat.com/security/updates/classification/" }, { "category" : "external", "summary" : "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management", "url" : "https://docs.redhat.com/en/documentation/cost_management_service/1-latest/html/getting_started_with_cost_management/steps-to-cost-management" }, { "category" : "self", "summary" : "Canonical URL", "url" : "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95264.json" } ], "title" : "Red Hat Security Advisory: Cost Management Metrics Operator Update", "tracking" : { "current_release_date" : "2026-11-09T16:42:08+00:00", "generator" : { "date" : "2026-11-09T16:42:08+00:00", "engine" : { "name" : "Red Hat SDEngine", "version" : "5.4.5" } }, "id" : "RHSA-2026:95264", "initial_release_date" : "2026-11-04T16:18:35+00:00", "revision_history" : [ { "date" : "2026-11-04T16:18:35+00:00", "number" : "1", "summary" : "Initial version" }, { "date" : "2026-11-04T16:18:40+00:00", "number" : "2", "summary" : "Last updated version" }, { "date" : "2026-11-09T16:42:08+00:00", "number" : "3", "summary" : "Last generated version" } ], "status" : "final", "version" : "3" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Cost Management 4", "product" : { "name" : "Cost Management 4", "product_id" : "Cost Management 4", "product_identification_helper" : { "cpe" : "cpe:/a:redhat:cost_management:4::el9" } } } ], "category" : "product_family", "name" : "Cost Management" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "product" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "product_id" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "product_identification_helper" : { "purl" : "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3Ae1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e?arch=amd64&repository_url=registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator&tag=1793202662" } } }, { "category" : "product_version", "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "product" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "product_id" : "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "product_identification_helper" : { "purl" : "pkg:oci/costmanagement-metrics-operator-bundle@sha256%3A86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3?arch=amd64&repository_url=registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle&tag=1793205914" } } } ], "category" : "architecture", "name" : "amd64" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "product" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "product_id" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "product_identification_helper" : { "purl" : "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3Abaeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25?arch=arm64&repository_url=registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator&tag=1793202662" } } } ], "category" : "architecture", "name" : "arm64" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le", "product" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le", "product_id" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le", "product_identification_helper" : { "purl" : "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3Afe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6?arch=ppc64le&repository_url=registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator&tag=1793202662" } } } ], "category" : "architecture", "name" : "ppc64le" }, { "branches" : [ { "category" : "product_version", "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "product" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "product_id" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "product_identification_helper" : { "purl" : "pkg:oci/costmanagement-metrics-rhel9-operator@sha256%3Ac1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0?arch=s390x&repository_url=registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator&tag=1793202662" } } } ], "category" : "architecture", "name" : "s390x" } ], "category" : "vendor", "name" : "Red Hat" } ], "relationships" : [ { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64 as a component of Cost Management 4", "product_id" : "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" }, "product_reference" : "registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "relates_to_product_reference" : "Cost Management 4" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64 as a component of Cost Management 4", "product_id" : "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64" }, "product_reference" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "relates_to_product_reference" : "Cost Management 4" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x as a component of Cost Management 4", "product_id" : "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x" }, "product_reference" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "relates_to_product_reference" : "Cost Management 4" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64 as a component of Cost Management 4", "product_id" : "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64" }, "product_reference" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "relates_to_product_reference" : "Cost Management 4" }, { "category" : "default_component_of", "full_product_name" : { "name" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le as a component of Cost Management 4", "product_id" : "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" }, "product_reference" : "registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le", "relates_to_product_reference" : "Cost Management 4" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2026-6368", "cwe" : { "id" : "CWE-1341", "name" : "Multiple Releases of Same Resource or Handle" }, "discovery_date" : "2026-08-10T19:01:24.040753+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2513608" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in glibc (GNU C Library). A local attacker or application using the wordexp function with the WRDE_APPEND flag can trigger the interface to return invalid memory in the we_wordv member. This invalid memory, when subsequently processed by wordfree, may cause the process to abort, leading to a Denial of Service (DoS).", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "glibc: glibc: Process abort due to invalid memory in wordexp", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This flaw in glibc has Moderate impact, as it can lead to a denial of service. Exploitation requires an application to specifically call `wordexp` with the `WRDE_APPEND` flag, followed by a `wordfree` call, which can result in a process abort. This vulnerability affects applications that utilize this particular programming pattern.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-6368" }, { "category" : "external", "summary" : "RHBZ#2513608", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2513608" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-6368", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-6368" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6368", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6368" }, { "category" : "external", "summary" : "https://sourceware.org/bugzilla/show_bug.cgi?id=34090", "url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=34090" }, { "category" : "external", "summary" : "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD", "url" : "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0014;h=1e9a0039f07471ddfe6816e5df04875bec409f92;hb=HEAD" } ], "release_date" : "2026-08-10T18:40:11.601000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "LOCAL", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "glibc: glibc: Process abort due to invalid memory in wordexp" }, { "cve" : "CVE-2026-6791", "cwe" : { "id" : "CWE-120", "name" : "Buffer Copy without Checking Size of Input" }, "discovery_date" : "2026-08-10T19:01:06.466966+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2513603" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in glibc. When processing paths that start with a tilde (~) followed by a username, the `wordexp` function can be forced to allocate an excessive amount of memory on the program's stack. A remote attacker could exploit this by providing a very long username, leading to a stack exhaustion and causing a denial of service (DoS) for the affected application.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "title" : "Vulnerability summary" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-6791" }, { "category" : "external", "summary" : "RHBZ#2513603", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2513603" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-6791", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-6791" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6791", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-6791" }, { "category" : "external", "summary" : "https://sourceware.org/bugzilla/show_bug.cgi?id=34091", "url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=34091" } ], "release_date" : "2026-08-10T18:41:25.122000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion" }, { "cve" : "CVE-2026-18374", "cwe" : { "id" : "CWE-134", "name" : "Use of Externally-Controlled Format String" }, "discovery_date" : "2026-08-27T20:19:54.467518+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2525256" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in the GNU C Library (glibc). This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability in glibc involves a heap buffer overflow when the `fopen` function processes an attacker-controlled mode string with an effectively empty `,ccs=` extension. Exploitation is highly complex as this specific usage pattern is not common in applications within typical Red Hat Enterprise Linux environments, significantly limiting its practical applicability.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-18374" }, { "category" : "external", "summary" : "RHBZ#2525256", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2525256" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-18374", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-18374" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-18374", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-18374" }, { "category" : "external", "summary" : "https://sourceware.org/bugzilla/show_bug.cgi?id=34574", "url" : "https://sourceware.org/bugzilla/show_bug.cgi?id=34574" }, { "category" : "external", "summary" : "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015", "url" : "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0015" } ], "release_date" : "2026-08-27T19:20:40.426000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "LOCAL", "availabilityImpact" : "LOW", "baseScore" : 4.9, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string" }, { "acknowledgments" : [ { "organization" : "Aisle Research", "summary" : "This issue was discovered by Red Hat." } ], "cve" : "CVE-2026-19542", "cwe" : { "id" : "CWE-121", "name" : "Stack-based Buffer Overflow" }, "discovery_date" : "2026-08-25T06:37:34.336000+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2523249" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "glibc: Fix out-of-bounds array write in tdelete", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Moderate impact vulnerability in glibc's `tdelete` function requires a local attacker with low privileges and user interaction to trigger an out-of-bounds write. While it could lead to denial of service or information disclosure, the high attack complexity limits its broader impact on Red Hat systems.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-19542" }, { "category" : "external", "summary" : "RHBZ#2523249", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2523249" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-19542", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-19542" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-19542", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-19542" } ], "release_date" : "2026-08-25T06:49:13.987000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "This issue is reachable only through applications that use glibc's tsearch/tdelete APIs and allow construction of extremely deep trees (on the order of a million nodes). Restrict such services to trusted clients and enforce process memory limits so large tree growth is impractical.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "LOCAL", "availabilityImpact" : "LOW", "baseScore" : 4.2, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "REQUIRED", "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "glibc: Fix out-of-bounds array write in tdelete" }, { "acknowledgments" : [ { "organization" : "Aisle Research", "summary" : "This issue was discovered by Red Hat." } ], "cve" : "CVE-2026-77117", "cwe" : { "id" : "CWE-835", "name" : "Loop with Unreachable Exit Condition" }, "discovery_date" : "2026-08-25T08:33:18.006000+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2523274" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Moderate impact flaw in glibc's SHIFT_JISX0213 to UCS-4 conversion can lead to a denial of service. Exploitation requires an attacker to provide specially crafted input that an application converts using this specific path, triggering a 2-byte sequence and a caller that retries after an E2BIG error with insufficient output space. Red Hat products are only affected if they utilize this uncommon conversion path and exhibit the described retry behavior.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-77117" }, { "category" : "external", "summary" : "RHBZ#2523274", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2523274" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-77117", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-77117" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-77117", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-77117" } ], "release_date" : "2026-08-25T08:36:10.013000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "Do not convert untrusted input using the SHIFT_JISX0213 character set (for example via iconv). Where conversion cannot be avoided, apply process CPU time limits and container cgroup resource limits so a hung converter cannot exhaust host resources.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "glibc: Non-progress DoS in SHIFT_JISX0213 ->" }, { "acknowledgments" : [ { "organization" : "Aisle Research", "summary" : "This issue was discovered by Red Hat." } ], "cve" : "CVE-2026-80489", "cwe" : { "id" : "CWE-835", "name" : "Loop with Unreachable Exit Condition" }, "discovery_date" : "2026-08-27T08:47:55.722000+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2524870" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in glibc. Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding (for example with iconv) can cause the converter to make no progress, hanging the calling application. Some EUC_JISX0213 sequences decode to two code points; if the output buffer has room for only the first, the second is stored in conversion state and returned as E2BIG, but that pending character is never cleared after it is emitted on the next call, so retries loop forever without consuming further input.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This Moderate denial-of-service flaw in glibc's EUC_JISX0213 to UCS-4 conversion requires attacker-controlled input on that uncommon charset path and an application that retries conversion with an output buffer small enough to split a two-code-point sequence. Impact is limited to process hang (availability only). The related SHIFT_JISX0213 defect is tracked separately as CVE-2026-77117.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-80489" }, { "category" : "external", "summary" : "RHBZ#2524870", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2524870" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-80489", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-80489" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80489", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80489" } ], "release_date" : "2026-08-27T08:49:17.578000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "To mitigate this avoid converting untrusted data with that charset, or disable the conversion path if unused. Where conversion of untrusted input cannot be avoided, restrict access to trusted clients and apply process CPU/resource limits to contain hang impact.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state" }, { "cve" : "CVE-2026-84782", "cwe" : { "id" : "CWE-125", "name" : "Out-of-bounds Read" }, "discovery_date" : "2026-09-18T19:58:21.939000+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2537080" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important severity because an unauthenticated network adversary can trigger process crashes or memory exposure without requiring local system privileges. Red Hat Enterprise Linux utilizes OpenSSL as the fundamental cryptographic provider across the operating system; however, overall exposure is limited because the flaw strictly affects software using Datagram Transport Layer Security (DTLS) over UDP under non-blocking I/O configurations. Standard TLS connections over TCP, which represent the typical deployment model for the majority of Red Hat workloads and system services, are unaffected.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-84782" }, { "category" : "external", "summary" : "RHBZ#2537080", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2537080" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-84782", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-84782" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84782", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84782" }, { "category" : "external", "summary" : "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782", "url" : "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782" } ], "release_date" : "2026-09-29T00:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "HIGH", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission" }, { "cve" : "CVE-2026-86145", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-09-05T05:20:54.676360+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2528993" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-86145" }, { "category" : "external", "summary" : "RHBZ#2528993", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2528993" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-86145", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-86145" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-86145", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-86145" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf", "url" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf" } ], "release_date" : "2026-09-05T05:09:25.571000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches—such as the reuse of cached memory workspaces—enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 8.2, "baseSeverity" : "HIGH", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions" }, { "cve" : "CVE-2026-89157", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-09-11T04:20:57.926410+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2531744" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: PCRE2: Out-of-bounds write via large pattern input", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This out-of-bounds write vulnerability in PCRE2 on 32-bit platforms could lead to data corruption with high integrity impact and potential denial of service. Exploitation requires an attacker to provide a specially crafted large pattern, but no privileges or user interaction are needed.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-89157" }, { "category" : "external", "summary" : "RHBZ#2531744", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531744" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-89157", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-89157" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89157", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89157" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "url" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "release_date" : "2026-09-11T04:05:27.069000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "LOCAL", "availabilityImpact" : "LOW", "baseScore" : 5.7, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "pcre2: PCRE2: Out-of-bounds write via large pattern input" }, { "cve" : "CVE-2026-89158", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-09-11T04:21:03.968148+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2531746" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "A Moderate impact flaw was found in PCRE2 affecting 32-bit platforms, where an integer overflow in the `pcre2_compile_32` function can lead to an out-of-bounds write. While exploitable over the network without requiring user interaction or privileges, the high attack complexity reduces its overall severity. Successful exploitation could result in high integrity impact, such as data corruption, or a low availability impact, leading to a denial of service.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-89158" }, { "category" : "external", "summary" : "RHBZ#2531746", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531746" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-89158", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-89158" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89158", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89158" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859", "url" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859" } ], "release_date" : "2026-09-11T04:07:21.973000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 6.5, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Moderate" } ], "title" : "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms" }, { "cve" : "CVE-2026-89161", "cwe" : { "id" : "CWE-1341", "name" : "Multiple Releases of Same Resource or Handle" }, "discovery_date" : "2026-09-11T04:21:06.963234+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2531747" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This is an Important memory corruption vulnerability in PCRE2's JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-89161" }, { "category" : "external", "summary" : "RHBZ#2531747", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2531747" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-89161", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-89161" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89161", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-89161" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/pull/937", "url" : "https://github.com/PCRE2Project/pcre2/pull/937" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "url" : "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "release_date" : "2026-09-11T04:11:51.666000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "LOCAL", "availabilityImpact" : "HIGH", "baseScore" : 7.4, "baseSeverity" : "HIGH", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match" }, { "cve" : "CVE-2026-103111", "cwe" : { "id" : "CWE-787", "name" : "Out-of-bounds Write" }, "discovery_date" : "2026-09-30T04:40:56.869940+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2543797" } ], "notes" : [ { "category" : "description", "text" : "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-103111" }, { "category" : "external", "summary" : "RHBZ#2543797", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2543797" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-103111", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-103111" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-103111", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-103111" }, { "category" : "external", "summary" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m", "url" : "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m" } ], "release_date" : "2026-09-30T04:13:59.115000+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "LOW", "attackVector" : "NETWORK", "availabilityImpact" : "LOW", "baseScore" : 7.6, "baseSeverity" : "HIGH", "confidentialityImpact" : "LOW", "integrityImpact" : "HIGH", "privilegesRequired" : "LOW", "scope" : "UNCHANGED", "userInteraction" : "NONE", "vectorString" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Important" } ], "title" : "pcre2: pcre2: Out-of-bounds write via crafted regular expression" }, { "cve" : "CVE-2026-114406", "cwe" : { "id" : "CWE-295", "name" : "Improper Certificate Validation" }, "discovery_date" : "2026-10-20T09:01:55.916000+00:00", "flags" : [ { "label" : "vulnerable_code_not_present", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] } ], "ids" : [ { "system_name" : "Red Hat Bugzilla ID", "text" : "2556046" } ], "notes" : [ { "category" : "description", "text" : "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.", "title" : "Vulnerability description" }, { "category" : "summary", "text" : "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "title" : "Vulnerability summary" }, { "category" : "other", "text" : "This CVE has been assigned to track trust store updates to distrust compromised certificates, but is not a vulnerability. For details, see RHSB-2026-012.", "title" : "Statement" }, { "category" : "general", "text" : "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title" : "CVSS score applicability" } ], "product_status" : { "fixed" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "known_not_affected" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64" ] }, "references" : [ { "category" : "self", "summary" : "Canonical URL", "url" : "https://access.redhat.com/security/cve/CVE-2026-114406" }, { "category" : "external", "summary" : "RHBZ#2556046", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2556046" }, { "category" : "external", "summary" : "RHSB-2026-012", "url" : "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012" }, { "category" : "external", "summary" : "https://www.cve.org/CVERecord?id=CVE-2026-114406", "url" : "https://www.cve.org/CVERecord?id=CVE-2026-114406" }, { "category" : "external", "summary" : "https://nvd.nist.gov/vuln/detail/CVE-2026-114406", "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-114406" } ], "release_date" : "2026-10-20T13:00:00+00:00", "remediations" : [ { "category" : "vendor_fix", "date" : "2026-11-04T16:18:35+00:00", "details" : "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ], "restart_required" : { "category" : "none" }, "url" : "https://access.redhat.com/errata/RHSA-2026:95264" }, { "category" : "workaround", "details" : "See the security bulletin for a detailed mitigation procedure.", "product_ids" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "scores" : [ { "cvss_v3" : { "attackComplexity" : "HIGH", "attackVector" : "NETWORK", "availabilityImpact" : "NONE", "baseScore" : 6.8, "baseSeverity" : "MEDIUM", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "privilegesRequired" : "NONE", "scope" : "UNCHANGED", "userInteraction" : "REQUIRED", "vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version" : "3.1" }, "products" : [ "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-operator-bundle@sha256:86a97ab9093a9a2290d3e51ce671c5f62dfcdd86dea9862d1f6c03c310980ae3_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:baeabe0fb1ffca46625c974966f6c5bd0f870e4a757b1afd421a123ece4e0b25_arm64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:c1b98ef61140fa706f3256859f98bf9621ad6b3bda8a5f1884e59b0be2b175d0_s390x", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:e1a40b10fc31b73dd4b5fdb274d109d740fe7dcbe2fddb2258e7e13f75ae865e_amd64", "Cost Management 4:registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator@sha256:fe9c5ec37b17a95787a67724231975f837bb8c259656cab45b3b6438c3b0efc6_ppc64le" ] } ], "threats" : [ { "category" : "impact", "details" : "Critical" } ], "title" : "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns" } ] }