CVE-2022-25869

Description

A flaw was found in Angular. All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of elements.</p> </div></div></section><section id="cve-mitigation"><div class="mitigation-container"><h2 class="section-headings">Mitigation</h2><div class="text-overflow-wrap"><p>Currently, there is no mitigation available for this vulnerability.<br /></p></div></div></section></div><div class="pf-v6-l-grid__item pf-v6-u-display-none-on-sm pf-v6-u-display-block-on-md pf-m-2-col-on-md" style="margin-bottom:0"></div><div class="pf-v6-l-grid__item pf-m-12-col pf-m-4-col-on-md"><section id="cve-additional-info"><div class="additional-info-container"><div class="pf-v6-c-accordion pf-m-toggle-start"><div class="pf-v6-c-accordion__item"><h3><button id="start-toggle-additional-info" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="pf-v6-c-accordion__toggle-text">Additional information</span></button></h3><div id="start-toggle-expand-additional-info" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><ul><li class="additional-info-items"><a href="https://bugzilla.redhat.com/show_bug.cgi?id=2362768">Bugzilla 2362768</a>: angularjs: Angular Cross-site Scripting (XSS)</li><li><a href='http://cwe.mitre.org/data/definitions/79.html'>CWE-79</a>: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')</li></ul></div></div></div></div></div></section><section id="cve-external-references"><div class="external-references-container"><div class="pf-v6-c-accordion pf-m-toggle-start"><div class="pf-v6-c-accordion__item"><h3><button id="start-toggle-external-references" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="pf-v6-c-accordion__toggle-text">External references</span></button></h3><div id="start-toggle-expand-external-references" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><ul><li class="external-reference-items"><a href="https://www.cve.org/CVERecord?id=CVE-2022-25869">https://www.cve.org/CVERecord?id=CVE-2022-25869</a></li><li class="external-reference-items"><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-25869">https://nvd.nist.gov/vuln/detail/CVE-2022-25869</a></li></ul></div></div></div></div></div></section></div></div><section id="cve-cvss"><div class="cvss-container pf-v6-l-grid pf-m-gutter"><h2 class="section-headings">Common Vulnerability Scoring System (CVSS) Score Details</h2><div class="pf-v6-l-grid__item pf-m-12-col pf-m-8-col-on-md pf-m-6-col-on-lg info-container"><div class="pf-v6-c-alert pf-m-info" data-ouia-component-type="PF6/Alert" data-ouia-safe="true" data-ouia-component-id="cvss-score-info-alert"><div class="pf-v6-c-alert__icon"><svg class="pf-v6-svg" viewBox="0 0 512 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M256 8C119.043 8 8 119.083 8 256c0 136.997 111.043 248 248 248s248-111.003 248-248C504 119.083 392.957 8 256 8zm0 110c23.196 0 42 18.804 42 42s-18.804 42-42 42-42-18.804-42-42 18.804-42 42-42zm56 254c0 6.627-5.373 12-12 12h-88c-6.627 0-12-5.373-12-12v-24c0-6.627 5.373-12 12-12h12v-64h-12c-6.627 0-12-5.373-12-12v-24c0-6.627 5.373-12 12-12h64c6.627 0 12 5.373 12 12v100h12c6.627 0 12 5.373 12 12v24z"></path></svg></div><h4 class="pf-v6-c-alert__title"><span class="pf-v6-screen-reader">Info alert:</span>Important note</h4><div class="pf-v6-c-alert__description"><p>CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative<a href="https://www.cve.org/ProgramOrganization/CNAs"> CVE Naming Authority (CNA) </a>source for its products and services (see <a href="https://access.redhat.com/security/updates/classification#cvss">Red Hat classifications</a>).</p></div></div></div><div class="cvss-score-data-tab-container"><p> The following CVSS metrics and score provided are preliminary and subject to review.</p><div class="pf-v6-l-grid"><div class="pf-v6-l-grid__item pf-m-12-col-on-sm pf-m-8-col-on-lg cvss-table-container-grid-item"><h3 class="cvss-score-heading">CVSS v3 Score Breakdown</h3><table aria-label="cvss table" role="grid" class="pf-v6-c-table pf-m-grid-md" data-ouia-component-type="PF6/Table" data-ouia-safe="true" data-ouia-component-id="cvss-score-table-v3"><thead class="pf-v6-c-table__thead"><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2943"><th tabindex="-1" scope="col" class="pf-v6-c-table__th"></th><th tabindex="-1" scope="col" aria-label="Red Hat" class="pf-v6-c-table__th">Red Hat</th><th tabindex="-1" scope="col" aria-label="NVD" class="pf-v6-c-table__th">NVD</th><th tabindex="-1" scope="col" aria-label="cve.org" class="pf-v6-c-table__th">cve.org</th></tr></thead><tbody role="rowgroup" class="pf-v6-c-table__tbody"><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2944"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold"> Base Score</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">4.2</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td cell-match">6.1</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2945"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Attack Vector</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">Network</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td">Network</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2946"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Attack Complexity</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">High</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td cell-match">Low</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2947"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Privileges Required</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">None</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td">None</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2948"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">User Interaction</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">Required</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td">Required</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2949"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Scope</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">Unchanged</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td cell-match">Changed</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2950"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Confidentiality</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">Low</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td">Low</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2951"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Integrity Impact</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">Low</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td">Low</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr><tr class="pf-v6-c-table__tr" aria-label="" data-ouia-component-type="PF6/TableRow" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-TableRow-2952"><td tabindex="-1" class="pf-v6-c-table__td pf-v6-u-font-weight-bold">Availability Impact</td><td tabindex="-1" data-label="Red Hat" class="pf-v6-c-table__td">None</td><td tabindex="-1" data-label="NVD" class="pf-v6-c-table__td">None</td><td tabindex="-1" data-label="cve.org" class="pf-v6-c-table__td">N/A</td></tr></tbody></table><div class="cvss-vector"><h3>Vector</h3><p class="cvss-vector-row"><span class="pf-v6-u-font-weight-bold cve-vector">Red Hat:</span> <span class="cvss-vector-value">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N</span></p><p class="cvss-vector-row"><span class="pf-v6-u-font-weight-bold cve-vector">NVD:</span> <span class="cvss-vector-value"><span><span class="">CVSS:3.1</span>/</span><span><span class="">AV:N</span>/</span><span><span class="vector-highlight">AC:L</span>/</span><span><span class="">PR:N</span>/</span><span><span class="">UI:R</span>/</span><span><span class="vector-highlight">S:C</span>/</span><span><span class="">C:L</span>/</span><span><span class="">I:L</span>/</span><span><span class="">A:N</span></span></span></p></div></div><div class="pf-v6-l-grid__item pf-m-12-col-on-sm pf-m-6-col-on-lg cvss-score-explanation-item"></div></div></div></div></section><section id="cve-cwe"><div class="cwe-container pf-v6-l-grid pf-m-gutter"><h2 class="section-headings">Understanding the Weakness (CWE)</h2><div class="pf-v6-l-grid"><div class="pf-v6-l-grid__item pf-m-12-col-on-sm pf-m-6-col-on-md pf-m-6-col-on-lg cwe-grid-item"><div id="" class="pf-v6-c-card" data-ouia-component-type="PF6/Card" data-ouia-safe="true" data-ouia-component-id="OUIA-Generated-Card-285"><div class="pf-v6-c-card__title"><div class="pf-v6-c-card__title-text"><a href="https://cwe.mitre.org/data/definitions/79.html">CWE-79 <svg class="pf-v6-svg" viewBox="0 0 512 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M432,320H400a16,16,0,0,0-16,16V448H64V128H208a16,16,0,0,0,16-16V80a16,16,0,0,0-16-16H48A48,48,0,0,0,0,112V464a48,48,0,0,0,48,48H400a48,48,0,0,0,48-48V336A16,16,0,0,0,432,320ZM488,0h-128c-21.37,0-32.05,25.91-17,41l35.73,35.73L135,320.37a24,24,0,0,0,0,34L157.67,377a24,24,0,0,0,34,0L435.28,133.32,471,169c15,15,41,4.5,41-17V24A24,24,0,0,0,488,0Z"></path></svg></a></div></div><div class="pf-v6-c-card__body"><div><h3>Access Control,Confidentiality</h3><p><span class="technical-impact-title">Technical Impact: </span><span class="technical-impact">Bypass Protection Mechanism; Read Application Data</span></p><p class="consequence-note">The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.</p></div><div><h3>Integrity,Confidentiality,Availability</h3><p><span class="technical-impact-title">Technical Impact: </span><span class="technical-impact">Execute Unauthorized Code or Commands</span></p><p class="consequence-note">In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, "drive-by hacking."</p></div><div><h3>Confidentiality,Integrity,Availability,Access Control</h3><p><span class="technical-impact-title">Technical Impact: </span><span class="technical-impact">Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Read Application Data</span></p><p class="consequence-note">The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.</p></div></div></div></div></div></div></section><section id="cve-faq"><div class="faqs-container pf-v6-l-grid pf-m-gutter"><div class="pf-v6-l-grid__item pf-m-12-col pf-m-8-col-on-md"><h2 class="section-headings">Frequently Asked Questions</h2><div class="pf-v6-c-accordion"><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_1" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>Why is Red Hat's CVSS v3 score or Impact different from other vendors?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_1" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span>For open source software shipped by multiple vendors, the CVSS base scores may vary for each vendor's version depending on the version they ship, how they ship it, the platform, and even how the software is compiled. This makes scoring of vulnerabilities difficult for third-party vulnerability databases such as NVD that only provide a single CVSS base score for each vulnerability. Red Hat scores reflect how a vulnerability affects our products specifically.<br><br>For more information, see <a href='https://access.redhat.com/solutions/762393'>https://access.redhat.com/solutions/762393</a>.</span></div></div></div><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_2" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>My product is listed as "Under investigation" or "Affected", when will Red Hat release a fix for this vulnerability?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_2" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span><ul><li>"Under investigation" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.</li><li>The term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.</li></ul></span></div></div></div><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_3" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>What can I do if my product is listed as "Will not fix"?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_3" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span>A "will not fix" status means that a fix for an affected product version is not planned or not possible due to complexity, which may create additional risk.<br><br>Available options depend mostly on the <a href='https://access.redhat.com/security/updates/classification/'>Impact</a> of the vulnerability and the current <a href='https://access.redhat.com/product-life-cycles/update_policies'>Life Cycle</a> phase of your product. Overall, you have the following options:<ul><li>Upgrade to a supported product version that includes a fix for this vulnerability (recommended).</li><li>Apply a mitigation (if one exists).</li><li>Customers with the Technical Account Manager (TAM) <a href='https://www.redhat.com/en/resources/rhel-security-select-add-on-datasheet'>RHEL Security Select Add-on</a> can review this CVE directly with their TAM.</li></ul></span></div></div></div><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_4" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>What can I do if my product is listed as "Fix deferred"?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_4" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span>A deferred status means that a fix for an affected product version is not guaranteed due to higher-priority development work.<br><br>Available options depend mostly on the <a href='https://access.redhat.com/security/updates/classification/'>Impact</a> of the vulnerability and the current <a href='https://access.redhat.com/product-life-cycles/update_policies'>Life Cycle</a> phase of your product. Overall, you have the following options:<ul><li>Apply a mitigation (if one exists).</li><li>Red Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.</li><li>Customers with the technical account manager (TAM) <a href='https://www.redhat.com/en/resources/rhel-security-select-add-on-datasheet'>RHEL Security Select Add-on</a> can review this CVE directly with their TAM.</li></ul></span></div></div></div><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_5" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>What is a mitigation?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_5" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span>A mitigation is an action that can be taken to reduce the impact of a security vulnerability, without deploying any fixes.</span></div></div></div><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_6" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>I have a Red Hat product but it is not in the above list, is it affected?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_6" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span>The listed products were found to include one or more of the components that this vulnerability affects. These products underwent a thorough evaluation to determine their affectedness by this vulnerability. Note that layered products (such as container-based offerings) that consume affected components from any of the products listed in this table may be affected and are not represented.</span></div></div></div><div class="pf-v6-c-accordion__item"><h3><button id="faq-toggle-faq_question_7" class="pf-v6-c-accordion__toggle" aria-expanded="false" type="button"><span class="pf-v6-c-accordion__toggle-text"><h3>Why is my security scanner reporting my product as vulnerable to this vulnerability even though my product version is fixed or not affected?</h3></span><span class="pf-v6-c-accordion__toggle-icon"><svg class="pf-v6-svg" viewBox="0 0 256 512" fill="currentColor" aria-hidden="true" role="img" width="1em" height="1em"><path d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span></button></h3><div id="faq-content-faq_question_7" class="pf-v6-c-accordion__expandable-content" hidden=""><div class="pf-v6-c-accordion__expandable-content-body"><span>In order to maintain code stability and compatibility, Red Hat usually does not rebase packages to entirely new versions. Instead, we <a href='https://access.redhat.com/security/updates/backporting'>backport</a> fixes and new features to an older version of the package we distribute. This can result in some security scanners that only consider the package version to report the package as vulnerable. To avoid this, we suggest that you use an approved vulnerability scanner from our <a href='https://connect.redhat.com/en/partner-with-us/red-hat-vulnerability-scanner-certification'>Red Hat Vulnerability Scanner Certification</a> program.</span></div></div></div></div><p class="glossary-link"><span>Not sure what something means?</span> Check out our <a href='https://access.redhat.com/security/glossary'>Security Glossary</a>.</p><p class="errata-notification"><span>Want to get errata notifications?</span> <a href='https://www.redhat.com/wapps/ugc/protected/notif.html?extIdCarryOver=true&sc_cid=701f2000001Css5AAC'>Sign up here</a>.</p></div></div></section><section id="cve-footer"><div class="footer-container pf-v6-l-grid pf-m-gutter"><p class="footer-clarification">For clarification or corrections, please contact <a href='https://access.redhat.com/security/team/contact/'>Red Hat Product Security</a>.</p><p class="footer-timestamp"><span>Last modified: </span><br/><span>CVE description copyright © 2021</span></p></div></section></div></div></main><div> <rh-footer color-palette="darker"> <a slot="logo" href="https://redhat.com/en"> <img alt="Red Hat" src="https://static.redhat.com/libs/redhat/brand-assets/2/corp/logo--on-dark.svg" loading="lazy" /> </a> <rh-footer-social-link slot="social-links" icon="linkedin"> <a href="https://www.linkedin.com/company/red-hat" data-analytics-region="social-links-exit" data-analytics-category="Footer|social-links" data-analytics-text="LinkedIn"> <span class="sr-only">LinkedIn</span> <svg class="social-icons" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30"><path d="M9.27 24.35h-4.3V10.52h4.3v13.83zM7.12 8.63a2.49 2.49 0 1 1 2.49-2.49 2.48 2.48 0 0 1-2.49 2.49Zm18.25 15.72h-4.29v-6.72C21.08 16 21 14 18.84 14s-2.58 1.75-2.58 3.55v6.84H12V10.52h4.12v1.89h.06a4.53 4.53 0 0 1 4.07-2.23c4.35 0 5.15 2.86 5.15 6.59v7.58Z"></path></svg> </a> </rh-footer-social-link> <rh-footer-social-link slot="social-links" icon="youtube"> <a href="https://www.youtube.com/user/RedHatVideos" data-analytics-region="social-links-exit" data-analytics-category="Footer|social-links" data-analytics-text="YouTube"> <span class="sr-only">YouTube</span> <svg class="social-icons" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30"><path d="M12.68 17.92V11.6l6.07 3.17-6.07 3.15ZM26 10.5a4.82 4.82 0 0 0-.9-2.23 3.21 3.21 0 0 0-2.25-.95C19.73 7.09 15 7.09 15 7.09s-4.72 0-7.87.23a3.21 3.21 0 0 0-2.25.95A4.82 4.82 0 0 0 4 10.5a34.76 34.76 0 0 0-.22 3.64v1.71A34.76 34.76 0 0 0 4 19.49a4.82 4.82 0 0 0 .9 2.23 3.74 3.74 0 0 0 2.47 1c1.8.17 7.65.23 7.65.23s4.73 0 7.87-.24a3.17 3.17 0 0 0 2.25-1 4.82 4.82 0 0 0 .9-2.23 34.76 34.76 0 0 0 .22-3.64v-1.7A34.76 34.76 0 0 0 26 10.5Z"></path></svg> </a> </rh-footer-social-link> <rh-footer-social-link slot="social-links" icon="facebook"> <a href="https://www.facebook.com/RedHat" data-analytics-region="social-links-exit" data-analytics-category="Footer|social-links" data-analytics-text="Facebook"> <span class="sr-only">Facebook</span> <svg class="social-icons" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30"><path d="M25.93 15.07a10.93 10.93 0 1 0-12.64 10.8v-7.64h-2.77v-3.16h2.77v-2.41c0-2.74 1.63-4.26 4.13-4.26a16.32 16.32 0 0 1 2.45.22v2.69h-1.38A1.58 1.58 0 0 0 16.71 13v2.05h3l-.48 3.16h-2.52v7.64a10.94 10.94 0 0 0 9.22-10.8Z"></path></svg> </a> </rh-footer-social-link> <rh-footer-social-link slot="social-links" icon="twitter"> <a href="https://x.com/RedHat" data-analytics-region="social-links-exit" data-analytics-category="Footer|social-links" data-analytics-text="Twitter"> <span class="sr-only">X, formerly Twitter</span> <svg class="social-icons" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 30 30"><path d="m16.78 13.54 6.96-8.09h-1.65l-6.04 7.02-4.82-7.02H5.67l7.3 10.62-7.3 8.48h1.65l6.38-7.42 5.1 7.42h5.56l-7.57-11.01Zm-2.26 2.62-.74-1.06L7.9 6.69h2.53l4.75 6.79.74 1.06 6.17 8.83h-2.53l-5.03-7.2Z"></path></svg> </a> </rh-footer-social-link> <h3 slot="links">Quick Links</h3> <ul slot="links"> <li><a class="download-software" href="https://access.redhat.com/downloads/">Downloads</a></li> <li><a class="manage-subscriptions" href="https://access.redhat.com/management">Subscriptions</a></li> <li><a class="support-cases" href="https://access.redhat.com/support">Support Cases</a></li> <li><a class="customer-service" href="https://access.redhat.com/support/customer-service">Customer Service</a></li> <li><a class="quick-docs" href="//docs.redhat.com/">Product Documentation</a></li> </ul> <h3 slot="links">Help</h3> <ul slot="links"> <li><a class="contact-us" href="https://access.redhat.com/support/contact/">Contact Us</a></li> <li><a class="cp-faqs" href="https://access.redhat.com/articles/33844">Customer Portal FAQ</a></li> <li><a class="login-problems" href="https://access.redhat.com/help/login_assistance">Log-in Assistance</a></li> </ul> <h3 slot="links">Site Info</h3> <ul slot="links"> <li><a class="trust-red-hat" href="https://www.redhat.com/en/trust">Trust Red Hat</a></li> <li><a class="browser-support-policy" href="https://www.redhat.com/en/about/browser-support">Browser Support Policy</a></li> <li><a class="accessibility" href="https://www.redhat.com/en/about/digital-accessibility">Accessibility</a></li> <li><a class="recognition" href="https://access.redhat.com/recognition/">Awards and Recognition</a></li> <li><a class="colophon" href="https://access.redhat.com/help/colophon/">Colophon</a></li> </ul> <h3 slot="links">Related Sites</h3> <ul slot="links"> <li><a href="https://www.redhat.com/" class="red-hat-com">redhat.com</a></li> <li><a href="http://developers.redhat.com/" class="red-hat-developers">developers.redhat.com</a></li> <li><a href="https://connect.redhat.com/" class="partner-connect">connect.redhat.com</a></li> <li><a href="https://cloud.redhat.com/" class="cloud-com">cloud.redhat.com</a></li> </ul>  <div class="site-status-container" slot="universal">  <rh-site-status></rh-site-status> </div>  <rh-footer-universal slot="universal"> <h3 slot="links-primary" data-analytics-text="Red Hat legal and privacy links" hidden>Red Hat legal and privacy links</h3> <ul slot="links-primary" data-analytics-region="page-footer-bottom-primary"> <li><a href="https://redhat.com/en/about/company" data-analytics-category="Footer|Corporate" data-analytics-text="About Red Hat">About Red Hat</a></li> <li><a href="https://redhat.com/en/jobs" data-analytics-category="Footer|Corporate" data-analytics-text="Jobs">Jobs</a></li> <li><a href="https://redhat.com/en/events" data-analytics-category="Footer|Corporate" data-analytics-text="Events">Events</a></li> <li><a href="https://redhat.com/en/about/office-locations" data-analytics-category="Footer|Corporate" data-analytics-text="Locations">Locations</a></li> <li><a href="https://redhat.com/en/contact" data-analytics-category="Footer|Corporate" data-analytics-text="Contact Red Hat">Contact Red Hat</a></li> <li><a href="https://redhat.com/en/blog" data-analytics-category="Footer|Corporate" data-analytics-text="Red Hat Blog">Red Hat Blog</a></li> <li><a href="https://www.redhat.com/en/about/our-culture/inclusion" data-analytics-category="Footer|Corporate" data-analytics-text="Inclusion at Red Hat">Inclusion at Red Hat</a></li> <li><a href="https://coolstuff.redhat.com/" data-analytics-category="Footer|Corporate" data-analytics-text="Cool Stuff Store">Cool Stuff Store</a></li> <li><a href="https://www.redhat.com/en/summit" data-analytics-category="Footer|Corporate" data-analytics-text="Red Hat Summit">Red Hat Summit</a></li> </ul> <rh-footer-copyright slot="links-secondary"> © 2026 Red Hat</rh-footer-copyright> <h3 slot="links-secondary" data-analytics-text="Red Hat legal and privacy links" hidden>Red Hat legal and privacy links</h3> <ul slot="links-secondary" data-analytics-region="page-footer-bottom-secondary"> <li><a href="https://redhat.com/en/about/privacy-policy" data-analytics-category="Footer|Red Hat legal and privacy links" data-analytics-text="Privacy statement">Privacy statement</a></li> <li><a href="https://redhat.com/en/about/terms-use" data-analytics-category="Footer|Red Hat legal and privacy links" data-analytics-text="Terms of use">Terms of use</a></li> <li><a href="https://redhat.com/en/about/all-policies-guidelines" data-analytics-category="Footer|Red Hat legal and privacy links" data-analytics-text="All policies and guidelines">All policies and guidelines</a></li> <li><a href="https://redhat.com/en/about/digital-accessibility" data-analytics-category="Footer|Red Hat legal and privacy links" data-analytics-text="Digital accessibility" class="active">Digital accessibility</a></li>   <li><span id="teconsent"></span></li> </ul> </rh-footer-universal> </rh-footer>  <nav id="to-top" aria-label="Back to Top"> <a class="btn_slideto" href="#masthead" aria-labelledby="to-top"> <span class="web-icon-upload" aria-hidden="true"></span> </a> </nav>  <div id="consent_blackbar"></div>  </div></div><script src="/security/cve/_next/static/chunks/webpack-81b61b5e857d881a.js" id="_R_" async=""></script><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n2:I[9766,[],\"\"]\n3:I[98924,[],\"\"]\n7:I[24431,[],\"OutletBoundary\"]\n9:I[15278,[],\"AsyncMetadataOutlet\"]\nb:I[24431,[],\"ViewportBoundary\"]\nd:I[24431,[],\"MetadataBoundary\"]\ne:\"$Sreact.suspense\"\n10:I[57150,[],\"\"]\n11:I[80622,[],\"IconMark\"]\n:HL[\"/security/cve/_next/static/css/bed1e8384b78533a.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/6044fc42b0ea9634.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/c32ec766f3ade53c.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/739c29a211328932.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/641b5af32c4cd6f2.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/c2c170bbc3eff450.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/abb69e4233a47a28.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/2e22b2c35a6c84de.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/9f3a18af73dad8b1.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/d59f23aa5157488b.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/1c2e13edc5b1862c.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/88dbee14b1aa1190.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/83250ca7b5e1ca43.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/db87bb3fd330e8a2.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/5951733feb6388f0.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/a922e537ce1b5b35.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/cdeba61ba4aa3779.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/31311fb22829c2e3.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/efc8e83af6b02c57.css\",\"style\"]\n:HL[\"/security/cve/_next/static/css/70f2637180a9b679.css\",\"style\"]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"pYbRK87wgnDzdoDl3ex33\",\"p\":\"/security/cve\",\"c\":[\"\",\"cve-2022-25869\"],\"i\":false,\"f\":[[[\"\",{\"children\":[[\"locale\",\"en\",\"d\"],{\"children\":[[\"cveID\",\"cve-2022-25869\",\"d\"],{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],[\"\",[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/bed1e8384b78533a.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/6044fc42b0ea9634.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"2\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/c32ec766f3ade53c.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"3\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/739c29a211328932.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"suppressHydrationWarning\":true,\"children\":[\"$\",\"body\",null,{\"suppressHydrationWarning\":true,\"children\":[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[\"$L4\",[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]}]]}],{\"children\":[[\"locale\",\"en\",\"d\"],[\"$\",\"$1\",\"c\",{\"children\":[null,\"$L5\"]}],{\"children\":[[\"cveID\",\"cve-2022-25869\",\"d\"],[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}],{\"children\":[\"__PAGE__\",[\"$\",\"$1\",\"c\",{\"children\":[\"$L6\",[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/641b5af32c4cd6f2.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"1\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/c2c170bbc3eff450.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"2\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/abb69e4233a47a28.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"3\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/2e22b2c35a6c84de.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"4\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/9f3a18af73dad8b1.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"5\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/d59f23aa5157488b.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"6\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/1c2e13edc5b1862c.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"7\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/88dbee14b1aa1190.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"8\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/83250ca7b5e1ca43.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"9\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/db87bb3fd330e8a2.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"10\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/5951733feb6388f0.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"11\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/a922e537ce1b5b35.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"12\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/cdeba61ba4aa3779.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"13\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/31311fb22829c2e3.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"14\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/efc8e83af6b02c57.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}],[\"$\",\"link\",\"15\",{\"rel\":\"stylesheet\",\"href\":\"/security/cve/_next/static/css/70f2637180a9b679.css\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],[\"$\",\"$L7\",null,{\"children\":[\"$L8\",[\"$\",\"$L9\",null,{\"promise\":\"$@a\"}]]}]]}],{},null,false]},null,false]},null,false]},null,false],[\"$\",\"$1\",\"h\",{\"children\":[null,[[\"$\",\"$Lb\",null,{\"children\":\"$Lc\"}],null],[\"$\",\"$Ld\",null,{\"children\":[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$e\",null,{\"fallback\":null,\"children\":\"$Lf\"}]}]}]]}],false]],\"m\":\"$undefined\",\"G\":[\"$10\",[]],\"s\":false,\"S\":false}\n"])</script><script>self.__next_f.push([1,"c:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n8:null\na:{\"metadata\":[[\"$\",\"title\",\"0\",{\"children\":\"CVE-2022-25869 - Red Hat Customer Portal\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"CVE Details App\"}],[\"$\",\"link\",\"2\",{\"rel\":\"icon\",\"href\":\"/security/cve/favicon.ico\",\"type\":\"image/x-icon\",\"sizes\":\"228x228\"}],[\"$\",\"$L11\",\"3\",{}]],\"error\":null,\"digest\":\"$undefined\"}\nf:\"$a:metadata\"\n4:E{\"digest\":\"NEXT_REDIRECT;replace;https://access.redhat.com/security/404;307;\"}\n"])</script><script>self.__next_f.push([1,"12:I[43073,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n14:I[1345,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n17:I[8365,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n"])</script><script>self.__next_f.push([1,"6:[\"$\",\"div\",null,{\"className\":\"cve-details-container\",\"children\":[[\"$\",\"$L12\",null,{\"searchApiId\":\"entity:node/93443:en\"}],\"$L13\",[\"$\",\"$L14\",null,{\"availableSections\":[{\"id\":\"cve-description\",\"label\":\"Description\",\"link\":\"#cve-description\"},{\"id\":\"cve-mitigation\",\"label\":\"Mitigation\",\"link\":\"#cve-mitigation\"},{\"id\":\"cve-affected-packages\",\"label\":\"Affected Packages\",\"link\":\"#cve-affected-packages\"},{\"id\":\"cve-cvss\",\"label\":\"CVSS Score Details\",\"link\":\"#cve-cvss\"},{\"id\":\"cve-cwe\",\"label\":\"Weakness (CWE)\",\"link\":\"#cve-cwe\"},{\"id\":\"cve-faq\",\"label\":\"FAQ\",\"link\":\"#cve-faq\"}]}],[\"$\",\"div\",null,{\"className\":\"pf-v6-l-grid pf-m-gutter\",\"children\":[[\"$\",\"div\",null,{\"className\":\"pf-v6-l-grid__item pf-m-12-col pf-m-6-col-on-md\",\"children\":[\"$L15\",\"\",\"\",\"$L16\"]}],[\"$\",\"div\",null,{\"className\":\"pf-v6-l-grid__item pf-v6-u-display-none-on-sm pf-v6-u-display-block-on-md pf-m-2-col-on-md\",\"style\":{\"marginBottom\":\"0\"}}],[\"$\",\"div\",null,{\"className\":\"pf-v6-l-grid__item pf-m-12-col pf-m-4-col-on-md\",\"children\":[[\"$\",\"$L17\",null,{\"cveDetails\":{\"__typename\":\"Cve\",\"language\":\"en\",\"title\":\"CVE-2022-25869\",\"url\":\"https://access.redhat.com/security/cve/cve-2022-25869\",\"searchApiId\":\"entity:node/93443:en\",\"field_cve_exploit_known\":false,\"field_cve_threat_severity_text\":\"Low\",\"field_cve_public_date\":\"2022-07-15T00:00:00.000Z\",\"changed\":\"2026-03-12T19:17:42.000Z\",\"field_cve_references_text\":[\"https://www.cve.org/CVERecord?id=CVE-2022-25869\",\"https://nvd.nist.gov/vuln/detail/CVE-2022-25869\"],\"field_cve_details_source_text\":\"Red Hat\",\"field_cve_change_log_txt\":\"\",\"unaffectedCveRecord\":false,\"bugzilla\":{\"__typename\":\"BugzillaInfo\",\"description\":\"angularjs: Angular Cross-site Scripting (XSS)\",\"id\":2362768,\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2362768\"},\"cweDetail\":{\"__typename\":\"CweDetail\",\"description\":\"\",\"html\":\"\u003ca href='http://cwe.mitre.org/data/definitions/79.html'\u003eCWE-79\u003c/a\u003e: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"data\":[{\"__typename\":\"CweData\",\"id\":\"CWE-79\"}]},\"cvss4\":{\"__typename\":\"Cvss4Score\",\"status\":\"NULL\",\"list\":{\"__typename\":\"Cvss4ListType\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"redHat\":{\"__typename\":\"Cvss4RedHat\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"nvd\":{\"__typename\":\"Cvss4Nvd\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"redHatScoreExplanation\":\"\"},\"cvss3\":{\"__typename\":\"Cvss3Score\",\"status\":\"DRAFT\",\"list\":{\"__typename\":\"Cvss3ListCve\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"redHat\":{\"__typename\":\"Cvss3RedHat\",\"score\":4.2,\"vector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N\",\"scoreBreakdown\":[{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Attack Vector\",\"value\":\"Network\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Attack Complexity\",\"value\":\"High\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Privileges Required\",\"value\":\"None\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"User Interaction\",\"value\":\"Required\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Scope\",\"value\":\"Unchanged\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Confidentiality\",\"value\":\"Low\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Integrity Impact\",\"value\":\"Low\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Availability Impact\",\"value\":\"None\"}]},\"nvd\":{\"__typename\":\"Cvss3Nvd\",\"score\":6.1,\"vector\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"scoreBreakdown\":[{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Attack Vector\",\"value\":\"Network\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Attack Complexity\",\"value\":\"Low\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Privileges Required\",\"value\":\"None\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"User Interaction\",\"value\":\"Required\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Scope\",\"value\":\"Changed\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Confidentiality\",\"value\":\"Low\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Integrity Impact\",\"value\":\"Low\"},{\"__typename\":\"CveScoreBreakdown\",\"label\":\"Availability Impact\",\"value\":\"None\"}]},\"redHatScoreExplanation\":\"\"},\"cvss2\":{\"__typename\":\"Cvss2Score\",\"status\":\"NULL\",\"list\":{\"__typename\":\"Cvss2ListCve\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"redHat\":{\"__typename\":\"Cvss2RedHat\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"nvd\":{\"__typename\":\"Cvss2Nvd\",\"score\":null,\"vector\":null,\"scoreBreakdown\":null},\"redHatScoreExplanation\":\"\"},\"field_cve_faq_txt\":[],\"locales\":[{\"__typename\":\"CveLocale\",\"locale\":\"en\",\"field_cve_statement_text\":\"\",\"field_cve_acknowledgement_text\":\"\",\"field_cve_details_text\":\"A flaw was found in Angular. All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.\",\"field_cve_mitigation_text\":\"\u003cp\u003eCurrently, there is no mitigation available for this vulnerability.\u003cbr /\u003e\u003c/p\u003e\",\"field_cve_vulnerability_url\":\"\"}]}}],\"$L18\"]}]]}],\"$L19\",\"$L1a\",\"$L1b\",\"\",\"$L1c\",\"$L1d\",\"$L1e\"]}]\n"])</script><script>self.__next_f.push([1,"1f:I[65017,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n20:I[13013,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n21:I[56913,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n22:I[41481,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n27:I[30449,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n28:I[67637,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n29:I[7361,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n2a:I[56005,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"467\",\"static/chunks/467-5f34946a4f8bde9b.js\",\"903\",\"static/chunks/app/%5Blocale%5D/%5BcveID%5D/page-17f312f350868839.js\"],\"default\"]\n18:[\"$\",\"$L1f\",null,{\"cveDetails\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails\"}]\n"])</script><script>self.__next_f.push([1,"19:[\"$\",\"$e\",null,{\"fallback\":null,\"children\":[\"$\",\"$L20\",null,{\"packagesRelease\":[{\"cpe\":\"cpe:/a:redhat:logging:5\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"advisory\":[],\"package\":\"openshift-logging/kibana6-rhel8\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/openshift/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:10\",\"product\":\"Red Hat Enterprise Linux 10\",\"advisory\":[],\"package\":\"firefox\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:10\",\"product\":\"Red Hat Enterprise Linux 10\",\"advisory\":[],\"package\":\"gjs\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:10\",\"product\":\"Red Hat Enterprise Linux 10\",\"advisory\":[],\"package\":\"grafana\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:10\",\"product\":\"Red Hat Enterprise Linux 10\",\"advisory\":[],\"package\":\"thunderbird\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:6\",\"product\":\"Red Hat Enterprise Linux 6\",\"advisory\":[],\"package\":\"firefox\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:6\",\"product\":\"Red Hat Enterprise Linux 6\",\"advisory\":[],\"package\":\"thunderbird\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:7\",\"product\":\"Red Hat Enterprise Linux 7\",\"advisory\":[],\"package\":\"firefox\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:7\",\"product\":\"Red Hat Enterprise Linux 7\",\"advisory\":[],\"package\":\"thunderbird\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:8\",\"product\":\"Red Hat Enterprise Linux 8\",\"advisory\":[],\"package\":\"firefox\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:8\",\"product\":\"Red Hat Enterprise Linux 8\",\"advisory\":[],\"package\":\"grafana\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:8\",\"product\":\"Red Hat Enterprise Linux 8\",\"advisory\":[],\"package\":\"mozjs60\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:8\",\"product\":\"Red Hat Enterprise Linux 8\",\"advisory\":[],\"package\":\"thunderbird\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"firefox\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"firefox:flatpak/firefox\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"gjs\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"grafana\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"polkit\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"thunderbird\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/o:redhat:enterprise_linux:9\",\"product\":\"Red Hat Enterprise Linux 9\",\"advisory\":[],\"package\":\"thunderbird:flatpak/thunderbird\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/errata/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:jboss_fuse:7\",\"product\":\"Red Hat Fuse 7\",\"advisory\":[],\"package\":\"io.hawt-hawtio-integration\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:jboss_fuse:7\",\"product\":\"Red Hat Fuse 7\",\"advisory\":[],\"package\":\"io.hawt-hawtio-online\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:jboss_fuse:7\",\"product\":\"Red Hat Fuse 7\",\"advisory\":[],\"package\":\"io.hawt-project\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:jboss_enterprise_application_platform:7\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"advisory\":[],\"package\":\"io.hawt-project\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:jboss_enterprise_application_platform:8\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"advisory\":[],\"package\":\"io.hawt-project\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:jbosseapxp\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"advisory\":[],\"package\":\"io.hawt-project\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:openstack:16.2\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"advisory\":[],\"package\":\"qpid-dispatch\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/openstack/platform/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:quay:3\",\"product\":\"Red Hat Quay 3\",\"advisory\":[],\"package\":\"quay/quay-rhel8\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/rhquay\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"},{\"cpe\":\"cpe:/a:redhat:red_hat_single_sign_on:7\",\"product\":\"Red Hat Single Sign-On 7\",\"advisory\":[],\"package\":\"org.keycloak-keycloak-parent\",\"state\":\"Not affected\",\"lifecycle_url\":\"https://access.redhat.com/support/policy/updates/jboss_notes/\",\"delegated_not_affected_justification\":\"Vulnerable Code not Present\",\"not_affected_justification\":\"Vulnerable Code not Present\"}],\"cveDetails\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails\"}]}]\n"])</script><script>self.__next_f.push([1,"1a:[\"$\",\"$L21\",null,{\"cvssList\":[{\"version\":3,\"redHat\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails:cvss3:redHat:scoreBreakdown\",\"nvd\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails:cvss3:nvd:scoreBreakdown\",\"list\":null,\"status\":\"DRAFT\",\"redHatScoreExplanation\":\"\",\"nvdVector\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"redHatVector\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N\",\"listVector\":null,\"redHatBaseScore\":4.2,\"nvdBaseScore\":6.1,\"listBaseScore\":null}]}]\n23:T42f,"])</script><script>self.__next_f.push([1,"\n\nUnderstand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies.\n\n\nFor any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters.\n\n\nParts of the same output document may require different encodings, which will vary depending on whether the output is in the:\n\n\n - HTML body\n\n - Element attributes (such as src=\"XYZ\")\n\n - URIs\n\n - JavaScript sections\n\n - Cascading Style Sheets and style property\n\netc. Note that HTML Entity Encoding is only appropriate for the HTML body.\n\nConsult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed.\n"])</script><script>self.__next_f.push([1,"24:Tdac,"])</script><script>self.__next_f.push([1,"\n\nAssume all input is malicious. Use an \"accept known good\" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.\n\n\nWhen performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, \"boat\" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as \"red\" or \"blue.\"\n\n\nDo not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.\n\n\nWhen dynamically constructing web pages, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. All input should be validated and cleansed, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. It is common to see data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended.\n\n\nNote that proper output encoding, escaping, and quoting is the most effective solution for preventing XSS, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent XSS, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, in a chat application, the heart emoticon (\"\u003c3\") would likely pass the validation step, since it is commonly used. However, it cannot be directly inserted into the web page because it contains the \"\u003c\" character, which would need to be escaped or otherwise handled. In this case, stripping the \"\u003c\" might reduce the risk of XSS, but it would produce incorrect behavior because the emoticon would not be recorded. This might seem to be a minor inconvenience, but it would be more important in a mathematical forum that wants to represent inequalities.\n\n\nEven if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address.\n\n\nEnsure that you perform input validation at well-defined interfaces within the application. This will help protect the application even if a component is reused or moved elsewhere.\n"])</script><script>self.__next_f.push([1,"25:T71d,"])</script><script>self.__next_f.push([1,"```\n\ttrustedSite.example.com/welcome.php?username=\u003cscript+type=\"text/javascript\"\u003e\n\tdocument.write('\\u003C\\u0064\\u0069\\u0076\\u0020\\u0069\\u0064\\u003D\\u0022\\u0073\n\t\\u0074\\u0065\\u0061\\u006C\\u0050\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\n\t\\u0022\\u003E\\u0050\\u006C\\u0065\\u0061\\u0073\\u0065\\u0020\\u004C\\u006F\\u0067\n\t\\u0069\\u006E\\u003A\\u003C\\u0066\\u006F\\u0072\\u006D\\u0020\\u006E\\u0061\\u006D\n\t\\u0065\\u003D\\u0022\\u0069\\u006E\\u0070\\u0075\\u0074\\u0022\\u0020\\u0061\\u0063\n\t\\u0074\\u0069\\u006F\\u006E\\u003D\\u0022\\u0068\\u0074\\u0074\\u0070\\u003A\\u002F\n\t\\u002F\\u0061\\u0074\\u0074\\u0061\\u0063\\u006B\\u002E\\u0065\\u0078\\u0061\\u006D\n\t\\u0070\\u006C\\u0065\\u002E\\u0063\\u006F\\u006D\\u002F\\u0073\\u0074\\u0065\\u0061\n\t\\u006C\\u0050\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u002E\\u0070\\u0068\n\t\\u0070\\u0022\\u0020\\u006D\\u0065\\u0074\\u0068\\u006F\\u0064\\u003D\\u0022\\u0070\n\t\\u006F\\u0073\\u0074\\u0022\\u003E\\u0055\\u0073\\u0065\\u0072\\u006E\\u0061\\u006D\n\t\\u0065\\u003A\\u0020\\u003C\\u0069\\u006E\\u0070\\u0075\\u0074\\u0020\\u0074\\u0079\n\t\\u0070\\u0065\\u003D\\u0022\\u0074\\u0065\\u0078\\u0074\\u0022\\u0020\\u006E\\u0061\n\t\\u006D\\u0065\\u003D\\u0022\\u0075\\u0073\\u0065\\u0072\\u006E\\u0061\\u006D\\u0065\n\t\\u0022\\u0020\\u002F\\u003E\\u003C\\u0062\\u0072\\u002F\\u003E\\u0050\\u0061\\u0073\n\t\\u0073\\u0077\\u006F\\u0072\\u0064\\u003A\\u0020\\u003C\\u0069\\u006E\\u0070\\u0075\n\t\\u0074\\u0020\\u0074\\u0079\\u0070\\u0065\\u003D\\u0022\\u0070\\u0061\\u0073\\u0073\n\t\\u0077\\u006F\\u0072\\u0064\\u0022\\u0020\\u006E\\u0061\\u006D\\u0065\\u003D\\u0022\n\t\\u0070\\u0061\\u0073\\u0073\\u0077\\u006F\\u0072\\u0064\\u0022\\u0020\\u002F\\u003E\n\t\\u003C\\u0069\\u006E\\u0070\\u0075\\u0074\\u0020\\u0074\\u0079\\u0070\\u0065\\u003D\n\t\\u0022\\u0073\\u0075\\u0062\\u006D\\u0069\\u0074\\u0022\\u0020\\u0076\\u0061\\u006C\n\t\\u0075\\u0065\\u003D\\u0022\\u004C\\u006F\\u0067\\u0069\\u006E\\u0022\\u0020\\u002F\n\t\\u003E\\u003C\\u002F\\u0066\\u006F\\u0072\\u006D\\u003E\\u003C\\u002F\\u0064\\u0069\\u0076\\u003E\\u000D');\u003c/script\u003e\n```"])</script><script>self.__next_f.push([1,"26:T6c9,"])</script><script>self.__next_f.push([1,"\n\nThe attack methods for XSS can vary depending on the type of XSS and the attacker's goal.\n\n\nReflected XSS exploits (Type 1)\n\n occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.\n\n\nIn a \n\nStored XSS exploit (Type 2)\n\n, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. For example, the attacker might inject XSS into a log message, which might not be handled properly when an administrator views the logs.\n\n\nDOM-based XSS (Type 0)\n\n generally involves server-controlled, trusted script that is sent to the client, such as JavaScript that performs sanity checks on a form before the user submits it. If the server-supplied script processes user-supplied data and then injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is possible.\n"])</script><script>self.__next_f.push([1,"1b:[\"$\",\"$L22\",null,{\"cwes\":[{\"ID\":\"79\",\"Name\":\"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\",\"Abstraction\":\"Base\",\"Structure\":\"Simple\",\"Status\":\"Stable\",\"Diagram\":\"/data/images/CWE-79-Diagram.png\",\"Description\":\"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.\",\"ExtendedDescription\":\"\\n\\nThere are many variants of cross-site scripting, characterized by a variety of terms or involving different attack topologies. However, they all indicate the same fundamental weakness: improper neutralization of dangerous input between the adversary and a victim.\\n\",\"LikelihoodOfExploit\":\"High\",\"RelatedWeaknesses\":[{\"Nature\":\"ChildOf\",\"CweID\":\"74\",\"ViewID\":\"1000\",\"Ordinal\":\"Primary\"},{\"Nature\":\"ChildOf\",\"CweID\":\"74\",\"ViewID\":\"1003\",\"Ordinal\":\"Primary\"},{\"Nature\":\"CanPrecede\",\"CweID\":\"494\",\"ViewID\":\"1000\"},{\"Nature\":\"PeerOf\",\"CweID\":\"352\",\"ViewID\":\"1000\"}],\"WeaknessOrdinalities\":[{\"Ordinality\":\"Resultant\"}],\"ApplicablePlatforms\":[{\"Type\":\"Language\",\"Class\":\"Not Language-Specific\",\"Prevalence\":\"Undetermined\"},{\"Type\":\"Technology\",\"Name\":\"AI/ML\",\"Prevalence\":\"Undetermined\"},{\"Type\":\"Technology\",\"Class\":\"Web Based\",\"Prevalence\":\"Often\"},{\"Type\":\"Technology\",\"Name\":\"Web Server\",\"Prevalence\":\"Undetermined\"}],\"BackgroundDetails\":[\"\\n\\nThe Same Origin Policy states that browsers should limit the resources accessible to scripts running on a given web site, or \\\"origin\\\", to the resources associated with that web site on the client-side, and not the client-side resources of any other sites or \\\"origins\\\". The goal is to prevent one site from being able to modify or read the contents of an unrelated site. Since the World Wide Web involves interactions between many sites, this policy is important for browsers to enforce.\\n\\n\\nWhen referring to XSS, the Domain of a website is roughly equivalent to the resources associated with that website on the client-side of the connection. That is, the domain can be thought of as all resources the browser is storing for the user's interactions with this particular site.\\n\"],\"AlternateTerms\":[{\"Term\":\"XSS\",\"Description\":\"A common abbreviation for Cross-Site Scripting.\"},{\"Term\":\"HTML Injection\",\"Description\":\"Used as a synonym of stored (Type 2) XSS.\"},{\"Term\":\"Reflected XSS / Non-Persistent XSS / Type 1 XSS\",\"Description\":\"Used when a server application reads data directly from the HTTP request and reflects it back in the HTTP response.\"},{\"Term\":\"Stored XSS / Persistent XSS / Type 2 XSS\",\"Description\":\"Used when a server-side application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content.\"},{\"Term\":\"DOM-Based XSS / Type 0 XSS\",\"Description\":\"Used when a client-side application performs the injection of XSS into the page by manipulating the Domain Object Model (DOM).\"},{\"Term\":\"CSS\",\"Description\":\"In the early years after initial discovery of XSS, \\\"CSS\\\" was a commonly-used acronym. However, this would cause confusion with \\\"Cascading Style Sheets,\\\" so usage of this acronym has declined significantly.\"}],\"ModesOfIntroduction\":[{\"Phase\":\"Implementation\",\"Note\":\"REALIZATION: This weakness is caused during implementation of an architectural security tactic.\"}],\"CommonConsequences\":[{\"Scope\":[\"Access Control\",\"Confidentiality\"],\"Impact\":[\"Bypass Protection Mechanism\",\"Read Application Data\"],\"Note\":\"The most common attack performed with cross-site scripting involves the disclosure of private information stored in user cookies, such as session information. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity on behalf of the victim to an attacker-controlled system (such as sending all site cookies to a given E-mail address). This could be especially dangerous to the site if the victim has administrator privileges to manage that site. This script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also.\"},{\"Scope\":[\"Integrity\",\"Confidentiality\",\"Availability\"],\"Impact\":[\"Execute Unauthorized Code or Commands\"],\"Note\":\"In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws, for example, \\\"drive-by hacking.\\\"\"},{\"Scope\":[\"Confidentiality\",\"Integrity\",\"Availability\",\"Access Control\"],\"Impact\":[\"Execute Unauthorized Code or Commands\",\"Bypass Protection Mechanism\",\"Read Application Data\"],\"Note\":\"The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. Some cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, running \\\"Active X\\\" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy, and modifying presentation of content.\"}],\"DetectionMethods\":[{\"Method\":\"Automated Static Analysis\",\"Description\":\"Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible, especially when multiple components are involved.\",\"Effectiveness\":\"Moderate\"},{\"Method\":\"Black Box\",\"Description\":\"Use the XSS Cheat Sheet [REF-714] or automated test-generation tools to help launch a wide variety of attacks against your web application. The Cheat Sheet contains many subtle XSS variations that are specifically targeted against weak XSS defenses.\",\"Effectiveness\":\"Moderate\",\"EffectivenessNotes\":\"With Stored XSS, the indirection caused by the data store can make it more difficult to find the problem. The tester must first inject the XSS string into the data store, then find the appropriate application functionality in which the XSS string is sent to other users of the application. These are two distinct steps in which the activation of the XSS can take place minutes, hours, or days after the XSS was originally injected into the data store.\"}],\"PotentialMitigations\":[{\"MitigationID\":\"MIT-4\",\"Phase\":[\"Architecture and Design\"],\"Strategy\":\"Libraries or Frameworks\",\"Description\":\"\\n\\nUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].\\n\\n\\nExamples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.\\n\"},{\"Phase\":[\"Implementation\",\"Architecture and Design\"],\"Description\":\"$23\"},{\"MitigationID\":\"MIT-6\",\"Phase\":[\"Architecture and Design\",\"Implementation\"],\"Strategy\":\"Attack Surface Reduction\",\"Description\":\"Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.\",\"Effectiveness\":\"Limited\",\"EffectivenessNotes\":\"This technique has limited effectiveness, but can be helpful when it is possible to store client state and sensitive information on the server side instead of in cookies, headers, hidden form fields, etc.\"},{\"MitigationID\":\"MIT-15\",\"Phase\":[\"Architecture and Design\"],\"Description\":\"For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.\"},{\"MitigationID\":\"MIT-27\",\"Phase\":[\"Architecture and Design\"],\"Strategy\":\"Parameterization\",\"Description\":\"If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.\"},{\"MitigationID\":\"MIT-30.1\",\"Phase\":[\"Implementation\"],\"Strategy\":\"Output Encoding\",\"Description\":\"\\n\\nUse and specify an output encoding that can be handled by the downstream component that is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an encoding is not specified, a downstream component may choose a different encoding, either by assuming a default encoding or automatically inferring which encoding is being used, which can be erroneous. When the encodings are inconsistent, the downstream component might treat some character or byte sequences as special, even if they are not special in the original encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks; they even might be able to bypass protection mechanisms that assume the original encoding is also being used by the downstream component.\\n\\n\\nThe problem of inconsistent output encodings often arises in web pages. If an encoding is not specified in an HTTP header, web browsers often guess about which encoding is being used. This can open up the browser to subtle XSS attacks.\\n\"},{\"MitigationID\":\"MIT-43\",\"Phase\":[\"Implementation\"],\"Description\":\"With Struts, write all data from form beans with the bean's filter attribute set to true.\"},{\"MitigationID\":\"MIT-31\",\"Phase\":[\"Implementation\"],\"Strategy\":\"Attack Surface Reduction\",\"Description\":\"To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as more recent versions of Internet Explorer and Firefox), this attribute can prevent the user's session cookie from being accessible to malicious client-side scripts that use document.cookie. This is not a complete solution, since HttpOnly is not supported by all browsers. More importantly, XmlHttpRequest and other powerful browser technologies provide read access to HTTP headers, including the Set-Cookie header in which the HttpOnly flag is set.\",\"Effectiveness\":\"Defense in Depth\"},{\"MitigationID\":\"MIT-5\",\"Phase\":[\"Implementation\"],\"Strategy\":\"Input Validation\",\"Description\":\"$24\"},{\"MitigationID\":\"MIT-21\",\"Phase\":[\"Architecture and Design\"],\"Strategy\":\"Enforcement by Conversion\",\"Description\":\"When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.\"},{\"MitigationID\":\"MIT-29\",\"Phase\":[\"Operation\"],\"Strategy\":\"Firewall\",\"Description\":\"Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].\",\"Effectiveness\":\"Moderate\",\"EffectivenessNotes\":\"An application firewall might not cover all possible input vectors. In addition, attack techniques might be available to bypass the protection mechanism, such as using malformed inputs that can still be processed by the component that receives those inputs. Depending on functionality, an application firewall might inadvertently reject or modify legitimate requests. Finally, some manual effort may be required for customization.\"},{\"MitigationID\":\"MIT-16\",\"Phase\":[\"Operation\",\"Implementation\"],\"Strategy\":\"Environment Hardening\",\"Description\":\"When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.\"}],\"DemonstrativeExamples\":[{\"Entries\":[{\"IntroText\":\"The following code displays a welcome message on a web page based on the HTTP GET username parameter (covers a Reflected XSS (Type 1) scenario).\"},{\"Nature\":\"Bad\",\"Language\":\"PHP\",\"ExampleCode\":\"```\\n\\t$username = $_GET['username'];\\n\\techo '\u003cdiv class=\\\"header\\\"\u003e Welcome, ' . $username . '\u003c/div\u003e';\\n```\"},{\"BodyText\":\"Because the parameter can be arbitrary, the url of the page could be modified so $username contains scripting syntax, such as\"},{\"Nature\":\"Attack\",\"ExampleCode\":\"```\\n\\thttp://trustedSite.example.com/welcome.php?username=\u003cScript Language=\\\"Javascript\\\"\u003ealert(\\\"You've been attacked!\\\");\u003c/Script\u003e\\n```\"},{\"BodyText\":\"This results in a harmless alert dialog popping up. Initially this might not appear to be much of a vulnerability. After all, why would someone enter a URL that causes malicious code to run on their own computer? The real danger is that an attacker will create the malicious URL, then use e-mail or social engineering tricks to lure victims into visiting a link to the URL. When victims click the link, they unwittingly reflect the malicious content through the vulnerable web application back to their own computers.\"},{\"BodyText\":\"More realistically, the attacker can embed a fake login box on the page, tricking the user into sending the user's password to the attacker:\"},{\"Nature\":\"Attack\",\"ExampleCode\":\"```\\n\\thttp://trustedSite.example.com/welcome.php?username=\u003cdiv id=\\\"stealPassword\\\"\u003ePlease Login:\u003cform name=\\\"input\\\" action=\\\"http://attack.example.com/stealPassword.php\\\" method=\\\"post\\\"\u003eUsername: \u003cinput type=\\\"text\\\" name=\\\"username\\\" /\u003e\u003cbr/\u003ePassword: \u003cinput type=\\\"password\\\" name=\\\"password\\\" /\u003e\u003cbr/\u003e\u003cinput type=\\\"submit\\\" value=\\\"Login\\\" /\u003e\u003c/form\u003e\u003c/div\u003e\\n```\"},{\"BodyText\":\"If a user clicks on this link then Welcome.php will generate the following HTML and send it to the user's browser:\"},{\"Nature\":\"Result\",\"ExampleCode\":\"```\\n\\t\u003cdiv class=\\\"header\\\"\u003e Welcome, \u003cdiv id=\\\"stealPassword\\\"\u003e Please Login:\\n\\t\\t\u003cform name=\\\"input\\\" action=\\\"attack.example.com/stealPassword.php\\\" method=\\\"post\\\"\u003e\\n\\t\\t\\tUsername: \u003cinput type=\\\"text\\\" name=\\\"username\\\" /\u003e\u003cbr/\u003e\\n\\t\\t\\tPassword: \u003cinput type=\\\"password\\\" name=\\\"password\\\" /\u003e\u003cbr/\u003e\\n\\t\\t\\t\u003cinput type=\\\"submit\\\" value=\\\"Login\\\" /\u003e\\n\\t\\t\u003c/form\u003e\\n\\t\u003c/div\u003e\u003c/div\u003e\\n```\"},{\"BodyText\":\"The trustworthy domain of the URL may falsely assure the user that it is OK to follow the link. However, an astute user may notice the suspicious text appended to the URL. An attacker may further obfuscate the URL (the following example links are broken into multiple lines for readability):\"},{\"Nature\":\"Attack\",\"ExampleCode\":\"```\\n\\ttrustedSite.example.com/welcome.php?username=%3Cdiv+id%3D%22\\n\\tstealPassword%22%3EPlease+Login%3A%3Cform+name%3D%22input\\n\\t%22+action%3D%22http%3A%2F%2Fattack.example.com%2FstealPassword.php\\n\\t%22+method%3D%22post%22%3EUsername%3A+%3Cinput+type%3D%22text\\n\\t%22+name%3D%22username%22+%2F%3E%3Cbr%2F%3EPassword%3A\\n\\t+%3Cinput+type%3D%22password%22+name%3D%22password%22\\n\\t+%2F%3E%3Cinput+type%3D%22submit%22+value%3D%22Login%22\\n\\t+%2F%3E%3C%2Fform%3E%3C%2Fdiv%3E%0D%0A\\n```\"},{\"BodyText\":\"The same attack string could also be obfuscated as:\"},{\"Nature\":\"Attack\",\"ExampleCode\":\"$25\"},{\"BodyText\":\"Both of these attack links will result in the fake login box appearing on the page, and users are more likely to ignore indecipherable text at the end of URLs.\"}]},{\"Entries\":[{\"IntroText\":\"The following code displays a Reflected XSS (Type 1) scenario.\"},{\"BodyText\":\"The following JSP code segment reads an employee ID, eid, from an HTTP request and displays it to the user.\"},{\"Nature\":\"Bad\",\"Language\":\"JSP\",\"ExampleCode\":\"```\\n\\t\u003c% String eid = request.getParameter(\\\"eid\\\"); %\u003e\\n\\t...\\n\\tEmployee ID: \u003c%= eid %\u003e\\n```\"},{\"BodyText\":\"The following ASP.NET code segment reads an employee ID number from an HTTP request and displays it to the user.\"},{\"Nature\":\"Bad\",\"Language\":\"ASP.NET\",\"ExampleCode\":\"```\\n\\t\u003c%\\n\\tprotected System.Web.UI.WebControls.TextBox Login;\\n\\tprotected System.Web.UI.WebControls.Label EmployeeID;\\n\\t...\\n\\tEmployeeID.Text = Login.Text;\\n\\t%\u003e\\n\\t\u003cp\u003e\u003casp:label id=\\\"EmployeeID\\\" runat=\\\"server\\\" /\u003e\u003c/p\u003e\\n```\"},{\"BodyText\":\"The code in this example operates correctly if the Employee ID variable contains only standard alphanumeric text. If it has a value that includes meta-characters or source code, then the code will be executed by the web browser as it displays the HTTP response.\"}]},{\"Entries\":[{\"IntroText\":\"The following code displays a Stored XSS (Type 2) scenario.\"},{\"BodyText\":\"The following JSP code segment queries a database for an employee with a given ID and prints the corresponding employee's name.\"},{\"Nature\":\"Bad\",\"Language\":\"JSP\",\"ExampleCode\":\"```\\n\\t\u003c%Statement stmt = conn.createStatement();\\n\\tResultSet rs = stmt.executeQuery(\\\"select * from emp where id=\\\"+eid);\\n\\tif (rs != null) {\\n\\t\\trs.next();\\n\\t\\tString name = rs.getString(\\\"name\\\");\\n\\t}%\u003e\\n\\tEmployee Name: \u003c%= name %\u003e\\n```\"},{\"BodyText\":\"The following ASP.NET code segment queries a database for an employee with a given employee ID and prints the name corresponding with the ID.\"},{\"Nature\":\"Bad\",\"Language\":\"ASP.NET\",\"ExampleCode\":\"```\\n\\t\u003c%\\n\\tprotected System.Web.UI.WebControls.Label EmployeeName;\\n\\t...\\n\\tstring query = \\\"select * from emp where id=\\\" + eid;\\n\\tsda = new SqlDataAdapter(query, conn);\\n\\tsda.Fill(dt);\\n\\tstring name = dt.Rows[0][\\\"Name\\\"];\\n\\t...\\n\\tEmployeeName.Text = name;%\u003e\\n\\t\u003cp\u003e\u003casp:label id=\\\"EmployeeName\\\" runat=\\\"server\\\" /\u003e\u003c/p\u003e\\n```\"},{\"BodyText\":\"This code can appear less dangerous because the value of name is read from a database, whose contents are apparently managed by the application. However, if the value of name originates from user-supplied data, then the database can be a conduit for malicious content. Without proper input validation on all data stored in the database, an attacker can execute malicious commands in the user's web browser.\"}]},{\"Entries\":[{\"IntroText\":\"The following code consists of two separate pages in a web application, one devoted to creating user accounts and another devoted to listing active users currently logged in. It also displays a Stored XSS (Type 2) scenario.\"},{\"BodyText\":\"CreateUser.php\"},{\"Nature\":\"Bad\",\"Language\":\"PHP\",\"ExampleCode\":\"```\\n\\t$username = mysql_real_escape_string($username);\\n\\t$fullName = mysql_real_escape_string($fullName);\\n\\t$query = sprintf('Insert Into users (username,password) Values (\\\"%s\\\",\\\"%s\\\",\\\"%s\\\")', $username, crypt($password),$fullName) ;\\n\\tmysql_query($query);\\n\\t/.../\\n```\"},{\"BodyText\":\"The code is careful to avoid a SQL injection attack (CWE-89) but does not stop valid HTML from being stored in the database. This can be exploited later when ListUsers.php retrieves the information:\"},{\"BodyText\":\"ListUsers.php\"},{\"Nature\":\"Bad\",\"Language\":\"PHP\",\"ExampleCode\":\"```\\n\\t$query = 'Select * From users Where loggedIn=true';\\n\\t$results = mysql_query($query);\\n\\tif (!$results) {\\n\\t\\texit;\\n\\t}\\n```\\n//Print list of users to page* \\n\\techo '\u003cdiv id=\\\"userlist\\\"\u003eCurrently Active Users:';\\n\\twhile ($row = mysql_fetch_assoc($results)) {\\n\\t```\\n\\t\\techo '\u003cdiv class=\\\"userNames\\\"\u003e'.$row['fullname'].'\u003c/div\u003e';\\n\\t}\\n\\techo '\u003c/div\u003e';\\n```\"},{\"BodyText\":\"The attacker can set their name to be arbitrary HTML, which will then be displayed to all visitors of the Active Users page. This HTML can, for example, be a password stealing Login message.\"}]},{\"Entries\":[{\"IntroText\":\"The following code is a simplistic message board that saves messages in HTML format and appends them to a file. When a new user arrives in the room, it makes an announcement:\"},{\"Nature\":\"Bad\",\"Language\":\"PHP\",\"ExampleCode\":\"```\\n\\t$name = $_COOKIE[\\\"myname\\\"];\\n\\t$announceStr = \\\"$name just logged in.\\\";\\n```\\n//save HTML-formatted message to file; implementation details are irrelevant for this example.* \\n\\t saveMessage($announceStr);\"},{\"BodyText\":\"An attacker may be able to perform an HTML injection (Type 2 XSS) attack by setting a cookie to a value like:\"},{\"Nature\":\"Attack\",\"ExampleCode\":\"```\\n\\t\u003cscript\u003edocument.alert('Hacked');\u003c/script\u003e\\n```\"},{\"BodyText\":\"The raw contents of the message file would look like:\"},{\"Nature\":\"Result\",\"ExampleCode\":\"```\\n\\t\u003cscript\u003edocument.alert('Hacked');\u003c/script\u003e has logged in.\\n```\"},{\"BodyText\":\"For each person who visits the message page, their browser would execute the script, generating a pop-up window that says \\\"Hacked\\\". More malicious attacks are possible; see the rest of this entry.\"}]},{\"ID\":\"DX-226\",\"Entries\":[{\"IntroText\":\"The following code attempts to stop XSS attacks by removing all occurences of \\\"script\\\" in an input string.\"},{\"Nature\":\"Bad\",\"Language\":\"Java\",\"ExampleCode\":\"```\\n\\tpublic String removeScriptTags(String input, String mask) {\\n\\t\\treturn input.replaceAll(\\\"script\\\", mask);\\n\\t}\\n```\"},{\"BodyText\":\"Because the code only checks for the lower-case \\\"script\\\" string, it can be easily defeated with upper-case script tags.\"}]}],\"ObservedExamples\":[{\"Reference\":\"CVE-2024-49038\",\"Description\":\"XSS in AI assistant\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2024-49038\"},{\"Reference\":\"CVE-2024-54142\",\"Description\":\"Plugin that enables AI features allows input with html entities, leading to XSS\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2024-54142\"},{\"Reference\":\"CVE-2021-25926\",\"Description\":\"Python Library Manager did not sufficiently neutralize a user-supplied search term, allowing reflected XSS.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2021-25926\"},{\"Reference\":\"CVE-2021-25963\",\"Description\":\"Python-based e-commerce platform did not escape returned content on error pages, allowing for reflected Cross-Site Scripting attacks.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2021-25963\"},{\"Reference\":\"CVE-2021-1879\",\"Description\":\"Universal XSS in mobile operating system, as exploited in the wild per CISA KEV.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2021-1879\"},{\"Reference\":\"CVE-2020-3580\",\"Description\":\"Chain: improper input validation (CWE-20) in firewall product leads to XSS (CWE-79), as exploited in the wild per CISA KEV.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2020-3580\"},{\"Reference\":\"CVE-2014-8958\",\"Description\":\"Admin GUI allows XSS through cookie.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2014-8958\"},{\"Reference\":\"CVE-2017-9764\",\"Description\":\"Web stats program allows XSS through crafted HTTP header.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2017-9764\"},{\"Reference\":\"CVE-2014-5198\",\"Description\":\"Web log analysis product allows XSS through crafted HTTP Referer header.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2014-5198\"},{\"Reference\":\"CVE-2008-5080\",\"Description\":\"Chain: protection mechanism failure allows XSS\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2008-5080\"},{\"Reference\":\"CVE-2006-4308\",\"Description\":\"Chain: incomplete denylist (CWE-184) only checks \\\"javascript:\\\" tag, allowing XSS (CWE-79) using other tags\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2006-4308\"},{\"Reference\":\"CVE-2007-5727\",\"Description\":\"Chain: incomplete denylist (CWE-184) only removes SCRIPT tags, enabling XSS (CWE-79)\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2007-5727\"},{\"Reference\":\"CVE-2008-5770\",\"Description\":\"Reflected XSS using the PATH_INFO in a URL\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2008-5770\"},{\"Reference\":\"CVE-2008-4730\",\"Description\":\"Reflected XSS not properly handled when generating an error message\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2008-4730\"},{\"Reference\":\"CVE-2008-5734\",\"Description\":\"Reflected XSS sent through email message.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2008-5734\"},{\"Reference\":\"CVE-2008-0971\",\"Description\":\"Stored XSS in a security product.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2008-0971\"},{\"Reference\":\"CVE-2008-5249\",\"Description\":\"Stored XSS using a wiki page.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2008-5249\"},{\"Reference\":\"CVE-2006-3568\",\"Description\":\"Stored XSS in a guestbook application.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2006-3568\"},{\"Reference\":\"CVE-2006-3211\",\"Description\":\"Stored XSS in a guestbook application using a javascript: URI in a bbcode img tag.\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2006-3211\"},{\"Reference\":\"CVE-2006-3295\",\"Description\":\"Chain: library file is not protected against a direct request (CWE-425), leading to reflected XSS (CWE-79).\",\"Link\":\"https://www.cve.org/CVERecord?id=CVE-2006-3295\"}],\"TaxonomyMappings\":[{\"TaxonomyName\":\"PLOVER\",\"EntryName\":\"Cross-site scripting (XSS)\"},{\"TaxonomyName\":\"7 Pernicious Kingdoms\",\"EntryName\":\"Cross-site Scripting\"},{\"TaxonomyName\":\"CLASP\",\"EntryName\":\"Cross-site scripting\"},{\"TaxonomyName\":\"OWASP Top Ten 2007\",\"EntryID\":\"A1\",\"EntryName\":\"Cross Site Scripting (XSS)\",\"MappingFit\":\"Exact\"},{\"TaxonomyName\":\"OWASP Top Ten 2004\",\"EntryID\":\"A1\",\"EntryName\":\"Unvalidated Input\",\"MappingFit\":\"CWE More Specific\"},{\"TaxonomyName\":\"OWASP Top Ten 2004\",\"EntryID\":\"A4\",\"EntryName\":\"Cross-Site Scripting (XSS) Flaws\",\"MappingFit\":\"Exact\"},{\"TaxonomyName\":\"WASC\",\"EntryID\":\"8\",\"EntryName\":\"Cross-site Scripting\"},{\"TaxonomyName\":\"Software Fault Patterns\",\"EntryID\":\"SFP24\",\"EntryName\":\"Tainted input to command\"},{\"TaxonomyName\":\"OMG ASCSM\",\"EntryID\":\"ASCSM-CWE-79\"}],\"RelatedAttackPatterns\":[\"209\",\"588\",\"591\",\"592\",\"63\",\"85\"],\"References\":[{\"ExternalReferenceID\":\"REF-709\",\"Authors\":[\"Jeremiah Grossman\",\"Robert \\\"RSnake\\\" Hansen\",\"Petko \\\"pdp\\\" D. Petkov\",\"Anton Rager\",\"Seth Fogie\"],\"Title\":\"XSS Attacks\",\"PublicationYear\":\"2007\",\"Publisher\":\"Syngress\"},{\"ExternalReferenceID\":\"REF-44\",\"Section\":\"\\\"Sin 2: Web-Server Related Vulnerabilities (XSS, XSRF, and Response Splitting).\\\" Page 31\",\"Authors\":[\"Michael Howard\",\"David LeBlanc\",\"John Viega\"],\"Title\":\"24 Deadly Sins of Software Security\",\"Publication\":\"McGraw-Hill\",\"PublicationYear\":\"2010\"},{\"ExternalReferenceID\":\"REF-44\",\"Section\":\"\\\"Sin 3: Web-Client Related Vulnerabilities (XSS).\\\" Page 63\",\"Authors\":[\"Michael Howard\",\"David LeBlanc\",\"John Viega\"],\"Title\":\"24 Deadly Sins of Software Security\",\"Publication\":\"McGraw-Hill\",\"PublicationYear\":\"2010\"},{\"ExternalReferenceID\":\"REF-712\",\"Title\":\"Cross-site scripting\",\"PublicationYear\":\"2008\",\"PublicationMonth\":\"08\",\"PublicationDay\":\"26\",\"Publisher\":\"Wikipedia\",\"URL\":\"https://en.wikipedia.org/wiki/Cross-site_scripting\",\"URLDate\":\"2023-04-07\"},{\"ExternalReferenceID\":\"REF-7\",\"Section\":\"Chapter 13, \\\"Web-Specific Input Issues\\\" Page 413\",\"Authors\":[\"Michael Howard\",\"David LeBlanc\"],\"Title\":\"Writing Secure Code\",\"Edition\":\"2nd Edition\",\"PublicationYear\":\"2002\",\"PublicationMonth\":\"12\",\"PublicationDay\":\"04\",\"Publisher\":\"Microsoft Press\",\"URL\":\"https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223\"},{\"ExternalReferenceID\":\"REF-714\",\"Authors\":[\"RSnake\"],\"Title\":\"XSS (Cross Site Scripting) Cheat Sheet\",\"URL\":\"http://ha.ckers.org/xss.html\"},{\"ExternalReferenceID\":\"REF-715\",\"Authors\":[\"Microsoft\"],\"Title\":\"Mitigating Cross-site Scripting With HTTP-only Cookies\",\"URL\":\"https://learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN\",\"URLDate\":\"2023-04-07\"},{\"ExternalReferenceID\":\"REF-716\",\"Authors\":[\"Mark Curphey, Microsoft\"],\"Title\":\"Anti-XSS 3.0 Beta and CAT.NET Community Technology Preview now Live!\",\"URL\":\"https://learn.microsoft.com/en-us/archive/blogs/cisg/anti-xss-3-0-beta-and-cat-net-community-technology-preview-now-live\",\"URLDate\":\"2023-04-07\"},{\"ExternalReferenceID\":\"REF-45\",\"Authors\":[\"OWASP\"],\"Title\":\"OWASP Enterprise Security API (ESAPI) Project\",\"URL\":\"https://owasp.org/www-project-enterprise-security-api/\",\"URLDate\":\"2025-07-24\"},{\"ExternalReferenceID\":\"REF-718\",\"Authors\":[\"Ivan Ristic\"],\"Title\":\"XSS Defense HOWTO\",\"URL\":\"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/xss-defense-howto/\",\"URLDate\":\"2023-04-07\"},{\"ExternalReferenceID\":\"REF-719\",\"Authors\":[\"OWASP\"],\"Title\":\"Web Application Firewall\",\"URL\":\"http://www.owasp.org/index.php/Web_Application_Firewall\"},{\"ExternalReferenceID\":\"REF-720\",\"Authors\":[\"Web Application Security Consortium\"],\"Title\":\"Web Application Firewall Evaluation Criteria\",\"URL\":\"http://projects.webappsec.org/w/page/13246985/Web%20Application%20Firewall%20Evaluation%20Criteria\",\"URLDate\":\"2023-04-07\"},{\"ExternalReferenceID\":\"REF-721\",\"Authors\":[\"RSnake\"],\"Title\":\"Firefox Implements httpOnly And is Vulnerable to XMLHTTPRequest\",\"PublicationYear\":\"2007\",\"PublicationMonth\":\"07\",\"PublicationDay\":\"19\"},{\"ExternalReferenceID\":\"REF-722\",\"Title\":\"XMLHttpRequest allows reading HTTPOnly cookies\",\"Publisher\":\"Mozilla\",\"URL\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=380418\"},{\"ExternalReferenceID\":\"REF-723\",\"Title\":\"Apache Wicket\",\"URL\":\"http://wicket.apache.org/\"},{\"ExternalReferenceID\":\"REF-724\",\"Authors\":[\"OWASP\"],\"Title\":\"XSS (Cross Site Scripting) Prevention Cheat Sheet\",\"URL\":\"http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet\"},{\"ExternalReferenceID\":\"REF-725\",\"Authors\":[\"OWASP\"],\"Title\":\"DOM based XSS Prevention Cheat Sheet\",\"URL\":\"http://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet\"},{\"ExternalReferenceID\":\"REF-726\",\"Authors\":[\"Jason Lam\"],\"Title\":\"Top 25 series - Rank 1 - Cross Site Scripting\",\"PublicationYear\":\"2010\",\"PublicationMonth\":\"02\",\"PublicationDay\":\"22\",\"Publisher\":\"SANS Software Security Institute\",\"URL\":\"https://www.sans.org/blog/top-25-series-rank-1-cross-site-scripting/\",\"URLDate\":\"2023-04-07\"},{\"ExternalReferenceID\":\"REF-62\",\"Section\":\"Chapter 17, \\\"Cross Site Scripting\\\", Page 1071\",\"Authors\":[\"Mark Dowd\",\"John McDonald\",\"Justin Schuh\"],\"Title\":\"The Art of Software Security Assessment\",\"Edition\":\"1st Edition\",\"PublicationYear\":\"2006\",\"Publisher\":\"Addison Wesley\"},{\"ExternalReferenceID\":\"REF-956\",\"Authors\":[\"Wikipedia\"],\"Title\":\"Samy (computer worm)\",\"URL\":\"https://en.wikipedia.org/wiki/Samy_(computer_worm)\",\"URLDate\":\"2018-01-16\"},{\"ExternalReferenceID\":\"REF-962\",\"Section\":\"ASCSM-CWE-79\",\"Authors\":[\"Object Management Group (OMG)\"],\"Title\":\"Automated Source Code Security Measure (ASCSM)\",\"PublicationYear\":\"2016\",\"PublicationMonth\":\"01\",\"URL\":\"http://www.omg.org/spec/ASCSM/1.0/\"},{\"ExternalReferenceID\":\"REF-1481\",\"Authors\":[\"D3FEND\"],\"Title\":\"D3FEND: Application Layer Firewall\",\"URL\":\"https://d3fend.mitre.org/dao/artifact/d3f:ApplicationLayerFirewall/\",\"URLDate\":\"2025-09-06\"},{\"ExternalReferenceID\":\"REF-1482\",\"Authors\":[\"D3FEND\"],\"Title\":\"D3FEND: D3-TL Trusted Library\",\"URL\":\"https://d3fend.mitre.org/technique/d3f:TrustedLibrary/\",\"URLDate\":\"2025-09-06\"}],\"MappingNotes\":{\"Usage\":\"Allowed\",\"Rationale\":\"This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.\",\"Comments\":\"Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.\",\"Reasons\":[\"Acceptable-Use\"]},\"Notes\":[{\"Type\":\"Other\",\"Note\":\"$26\"},{\"Type\":\"Other\",\"Note\":\"\\n\\nAttackers frequently use a variety of methods to encode the malicious portion of the attack, such as URL encoding or Unicode, so the request looks less suspicious. Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site.\\n\"},{\"Type\":\"Other\",\"Note\":\"\\n\\nCross-site scripting (XSS) vulnerabilities occur when:\\n\\n\\n 1. Untrusted data enters a web application, typically from a web request.\\n\\n 1. The web application dynamically generates a web page that contains this untrusted data.\\n\\n 1. During page generation, the application does not prevent the data from containing content that is executable by a web browser, such as JavaScript, HTML tags, HTML attributes, mouse events, Flash, ActiveX, etc.\\n\\n 1. A victim visits the generated web page through a web browser, which contains malicious script that was injected using the untrusted data.\\n\\n 1. Since the script comes from a web page that was sent by the web server, the victim's web browser executes the malicious script in the context of the web server's domain.\\n\\n 1. This effectively violates the intention of the web browser's same-origin policy, which states that scripts in one domain should not be able to access resources or run code in a different domain.\\n\\n\"},{\"Type\":\"Relationship\",\"Note\":\"\\n\\nThere can be a close relationship between XSS and CSRF (CWE-352). An attacker might use CSRF in order to trick the victim into submitting requests to the server in which the requests contain an XSS payload. A well-known example of this was the Samy worm on MySpace [REF-956]. The worm used XSS to insert malicious HTML sequences into a user's profile and add the attacker as a MySpace friend. MySpace friends of that victim would then execute the payload to modify their own profiles, causing the worm to propagate exponentially. Since the victims did not intentionally insert the malicious script themselves, CSRF was a root cause.\\n\"},{\"Type\":\"Applicable Platform\",\"Note\":\"\\n\\nXSS flaws are very common in web applications, since they require a great deal of developer discipline to avoid them.\\n\"}],\"ContentHistory\":[{\"Type\":\"Submission\",\"SubmissionName\":\"PLOVER\",\"SubmissionDate\":\"2006-07-19\",\"SubmissionVersion\":\"Draft 3\",\"SubmissionReleaseDate\":\"2006-07-19\"},{\"Type\":\"Modification\",\"ModificationName\":\"Eric Dalci\",\"ModificationOrganization\":\"Cigital\",\"ModificationDate\":\"2008-07-01\",\"ModificationComment\":\"updated Time_of_Introduction\",\"ModificationVersion\":\"1.0\",\"ModificationReleaseDate\":\"2008-09-09\"},{\"Type\":\"Modification\",\"ModificationOrganization\":\"Veracode\",\"ModificationDate\":\"2008-08-15\",\"ModificationComment\":\"Suggested OWASP Top Ten 2004 mapping\",\"ModificationVersion\":\"1.0\",\"ModificationReleaseDate\":\"2008-09-09\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2008-09-08\",\"ModificationComment\":\"updated Alternate_Terms, Applicable_Platforms, Background_Details, Common_Consequences, Description, Relationships, Other_Notes, References, Taxonomy_Mappings, Weakness_Ordinalities\",\"ModificationVersion\":\"1.0\",\"ModificationReleaseDate\":\"2008-09-09\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2009-01-12\",\"ModificationComment\":\"updated Alternate_Terms, Applicable_Platforms, Background_Details, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Enabling_Factors_for_Exploitation, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationships\",\"ModificationVersion\":\"1.2\",\"ModificationReleaseDate\":\"2009-01-12\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2009-03-10\",\"ModificationComment\":\"updated Potential_Mitigations\",\"ModificationVersion\":\"1.3\",\"ModificationReleaseDate\":\"2009-03-10\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2009-05-27\",\"ModificationComment\":\"updated Name\",\"ModificationVersion\":\"1.4\",\"ModificationReleaseDate\":\"2009-05-27\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2009-07-27\",\"ModificationComment\":\"updated Description\",\"ModificationVersion\":\"1.5\",\"ModificationReleaseDate\":\"2009-07-27\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2009-10-29\",\"ModificationComment\":\"updated Observed_Examples, Relationships\",\"ModificationVersion\":\"1.6\",\"ModificationReleaseDate\":\"2009-10-29\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2009-12-28\",\"ModificationComment\":\"updated Demonstrative_Examples, Description, Detection_Factors, Enabling_Factors_for_Exploitation, Observed_Examples\",\"ModificationVersion\":\"1.7\",\"ModificationReleaseDate\":\"2009-12-28\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2010-02-16\",\"ModificationComment\":\"updated Applicable_Platforms, Detection_Factors, Potential_Mitigations, References, Relationships, Taxonomy_Mappings\",\"ModificationVersion\":\"1.8\",\"ModificationReleaseDate\":\"2010-02-16\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2010-04-05\",\"ModificationComment\":\"updated Description, Potential_Mitigations, Related_Attack_Patterns\",\"ModificationVersion\":\"1.8.1\",\"ModificationReleaseDate\":\"2010-04-05\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2010-06-21\",\"ModificationComment\":\"updated Common_Consequences, Description, Name, Potential_Mitigations, References, Relationships\",\"ModificationVersion\":\"1.9\",\"ModificationReleaseDate\":\"2010-06-21\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2010-09-27\",\"ModificationComment\":\"updated Potential_Mitigations\",\"ModificationVersion\":\"1.10\",\"ModificationReleaseDate\":\"2010-09-27\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2011-03-29\",\"ModificationComment\":\"updated Demonstrative_Examples, References\",\"ModificationVersion\":\"1.12\",\"ModificationReleaseDate\":\"2011-03-30\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2011-06-01\",\"ModificationComment\":\"updated Common_Consequences\",\"ModificationVersion\":\"1.13\",\"ModificationReleaseDate\":\"2011-06-01\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2011-06-27\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"2.0\",\"ModificationReleaseDate\":\"2011-06-27\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2011-09-13\",\"ModificationComment\":\"updated Detection_Factors, Potential_Mitigations\",\"ModificationVersion\":\"2.1\",\"ModificationReleaseDate\":\"2011-09-13\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2012-05-11\",\"ModificationComment\":\"updated References, Relationships\",\"ModificationVersion\":\"2.2\",\"ModificationReleaseDate\":\"2012-05-15\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2012-10-30\",\"ModificationComment\":\"updated Potential_Mitigations\",\"ModificationVersion\":\"2.3\",\"ModificationReleaseDate\":\"2012-10-30\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2013-07-17\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"2.5\",\"ModificationReleaseDate\":\"2013-07-17\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2014-07-30\",\"ModificationComment\":\"updated Relationships, Taxonomy_Mappings\",\"ModificationVersion\":\"2.8\",\"ModificationReleaseDate\":\"2014-07-31\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2015-12-07\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"2.9\",\"ModificationReleaseDate\":\"2015-12-07\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2017-01-19\",\"ModificationComment\":\"updated Related_Attack_Patterns\",\"ModificationVersion\":\"2.10\",\"ModificationReleaseDate\":\"2017-01-19\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2017-05-03\",\"ModificationComment\":\"updated Related_Attack_Patterns, Relationships\",\"ModificationVersion\":\"2.11\",\"ModificationReleaseDate\":\"2017-05-05\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2017-11-08\",\"ModificationComment\":\"updated Applicable_Platforms, Causal_Nature, Demonstrative_Examples, Enabling_Factors_for_Exploitation, Likelihood_of_Exploit, Modes_of_Introduction, References, Relationships\",\"ModificationVersion\":\"3.0\",\"ModificationReleaseDate\":\"2017-11-08\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2018-03-27\",\"ModificationComment\":\"updated Alternate_Terms, Demonstrative_Examples, Description, Observed_Examples, References, Relationship_Notes, Relationships\",\"ModificationVersion\":\"3.1\",\"ModificationReleaseDate\":\"2018-03-27\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2019-01-03\",\"ModificationComment\":\"updated References, Relationships, Taxonomy_Mappings\",\"ModificationVersion\":\"3.2\",\"ModificationReleaseDate\":\"2019-01-03\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2019-09-19\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"3.4\",\"ModificationReleaseDate\":\"2019-09-19\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2020-02-24\",\"ModificationComment\":\"updated Applicable_Platforms, Potential_Mitigations, Relationships\",\"ModificationVersion\":\"4.0\",\"ModificationReleaseDate\":\"2020-02-24\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2020-06-25\",\"ModificationComment\":\"updated Observed_Examples, Potential_Mitigations\",\"ModificationVersion\":\"4.1\",\"ModificationReleaseDate\":\"2020-06-25\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2020-08-20\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.2\",\"ModificationReleaseDate\":\"2020-08-20\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2020-12-10\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.3\",\"ModificationReleaseDate\":\"2020-12-10\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2021-03-15\",\"ModificationComment\":\"updated Demonstrative_Examples, Description\",\"ModificationVersion\":\"4.4\",\"ModificationReleaseDate\":\"2021-03-15\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2021-07-20\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.5\",\"ModificationReleaseDate\":\"2021-07-20\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2021-10-28\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.6\",\"ModificationReleaseDate\":\"2021-10-28\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2022-06-28\",\"ModificationComment\":\"updated Observed_Examples, Relationships\",\"ModificationVersion\":\"4.8\",\"ModificationReleaseDate\":\"2022-06-28\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2022-10-13\",\"ModificationComment\":\"updated Background_Details, Observed_Examples\",\"ModificationVersion\":\"4.9\",\"ModificationReleaseDate\":\"2022-10-13\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2023-01-31\",\"ModificationComment\":\"updated Alternate_Terms, Demonstrative_Examples, Description\",\"ModificationVersion\":\"4.10\",\"ModificationReleaseDate\":\"2023-01-31\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2023-04-27\",\"ModificationComment\":\"updated References, Relationships, Time_of_Introduction\",\"ModificationVersion\":\"4.11\",\"ModificationReleaseDate\":\"2023-04-27\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2023-06-29\",\"ModificationComment\":\"updated Mapping_Notes, Relationships\",\"ModificationVersion\":\"4.12\",\"ModificationReleaseDate\":\"2023-06-29\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2024-02-29\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.14\",\"ModificationReleaseDate\":\"2024-02-29\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2024-11-19\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.16\",\"ModificationReleaseDate\":\"2024-11-19\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2025-04-03\",\"ModificationComment\":\"updated Alternate_Terms, Common_Consequences, Description, Diagram, Other_Notes\",\"ModificationVersion\":\"4.17\",\"ModificationReleaseDate\":\"2025-04-03\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2025-09-09\",\"ModificationComment\":\"updated Applicable_Platforms, Observed_Examples, Potential_Mitigations, References\",\"ModificationVersion\":\"4.18\",\"ModificationReleaseDate\":\"2025-09-09\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2025-12-11\",\"ModificationComment\":\"updated Applicable_Platforms, Demonstrative_Examples, Relationships\",\"ModificationVersion\":\"4.19\",\"ModificationReleaseDate\":\"2025-12-11\"},{\"Type\":\"Modification\",\"ModificationName\":\"CWE Content Team\",\"ModificationOrganization\":\"MITRE\",\"ModificationDate\":\"2026-04-30\",\"ModificationComment\":\"updated Relationships\",\"ModificationVersion\":\"4.20\",\"ModificationReleaseDate\":\"2026-04-30\"},{\"Type\":\"Contribution\",\"ContributionName\":\"Abhi Balakrishnan\",\"ContributionDate\":\"2025-03-10\",\"ContributionComment\":\"Provided diagram to improve CWE usability.\",\"ContributionType\":\"Content\",\"ContributionVersion\":\"4.17\",\"ContributionReleaseDate\":\"2025-04-03\"},{\"Type\":\"Rename\",\"PreviousEntryName\":\"Cross-site Scripting (XSS)\",\"Date\":\"2008-04-11\"},{\"Type\":\"Rename\",\"PreviousEntryName\":\"Failure to Sanitize Directives in a Web Page (aka 'Cross-site scripting' (XSS))\",\"Date\":\"2009-01-12\"},{\"Type\":\"Rename\",\"PreviousEntryName\":\"Failure to Preserve Web Page Structure (aka 'Cross-site Scripting')\",\"Date\":\"2009-05-27\"},{\"Type\":\"Rename\",\"PreviousEntryName\":\"Failure to Preserve Web Page Structure ('Cross-site Scripting')\",\"Date\":\"2010-06-21\"}]}]}]\n"])</script><script>self.__next_f.push([1,"1c:[\"$\",\"$L27\",null,{\"cveDetails\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails\"}]\n1d:[\"$\",\"$L28\",null,{\"packages\":\"$19:props:children:props:packagesRelease\",\"isUnaffectedCveRecord\":false}]\n1e:[\"$\",\"$L29\",null,{\"cveDetails\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails\"}]\n13:[\"$\",\"$L2a\",null,{\"cveDetails\":\"$6:props:children:3:props:children:2:props:children:0:props:cveDetails\",\"cvssList\":\"$1a:props:cvssList\",\"title\":[\"$\",\"h1\",null,{\"children\":\"CVE-2022-25869\"}]}]\n15:[\"$\",\"section\",null,{\"id\":\"cve-description\",\"children\":[\"$\",\"div\",null,{\"className\":\"description-container\",\"children\":[[\"$\",\"h2\",null,{\"className\":\"section-headings\",\"children\":\"Description\"}],[\"$\",\"div\",null,{\"className\":\"text-overflow-wrap\",\"dangerouslySetInnerHTML\":{\"__html\":\"\u003cp\u003eA flaw was found in Angular. All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of \u003ctextarea\u003e elements.\u003c/p\u003e\\n\"}}],false,false]}]}]\n16:[\"$\",\"section\",null,{\"id\":\"cve-mitigation\",\"children\":[\"$\",\"div\",null,{\"className\":\"mitigation-container\",\"children\":[[\"$\",\"h2\",null,{\"className\":\"section-headings\",\"children\":\"Mitigation\"}],[\"$\",\"div\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"\u003cp\u003eCurrently, there is no mitigation available for this vulnerability.\u003cbr /\u003e\u003c/p\u003e\"},\"className\":\"text-overflow-wrap\"}]]}]}]\n"])</script><script>self.__next_f.push([1,"2b:Taef0,"])</script><script>self.__next_f.push([1,"\u003c!-- CP_PRIMER_HEADER --\u003e\n\u003cdiv class=\"cphub-alerts-wrapper\"\u003e\n \u003cdiv id=\"cphub-alerts-container\" class=\"cphub-alerts cphub-alerts--banner\"\u003e\u003c/div\u003e\n \u003c/div\u003e\n \u003cdiv id=\"cphub-alerts-container--toast\" class=\"cphub-alerts cphub-alerts--toast\"\u003e\u003c/div\u003e\n \u003cdiv id=\"pers-top-page-wrap\" class=\"top-page-wrap pers-loader-bg\"\u003e\n\n \u003c!--googleoff: all--\u003e\n \u003cheader class=\"masthead\" id=\"masthead\"\u003e\n\n \u003ca href=\"#pfe-navigation\" id=\"global-skip-to-nav\" class=\"skip-link visually-hidden\"\u003eSkip to navigation\u003c/a\u003e\n \u003ca href=\"#cp-main\" class=\"skip-link visually-hidden\"\u003eSkip to main content\u003c/a\u003e\n\n \n \u003cnav id=\"portal-utility-nav\" class=\"utility-navigation utility-navigation--bar hidden-at-mobile\" data-analytics-region=\"universal-navigation\" aria-labelledby=\"nav__utility-nav--desktop\"\u003e\n \u003ch3 id=\"nav__utility-nav--desktop\" class=\"element-invisible\"\u003e\n Utilities\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__utility-nav--desktop\"\u003e\n \u003cli id=\"nav-subscription\" data-portal-tour-1=\"1\"\u003e\n \u003ca class=\"top-nav-subscriptions\" data-analytics-level=\"2\" data-analytics-category=\"Utilities\" data-analytics-text=\"Subscription\" href=\"https://access.redhat.com/management/\"\u003e\n Subscriptions\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli id=\"nav-downloads\" data-portal-tour-1=\"2\"\u003e\n \u003ca class=\"top-nav-downloads\" data-analytics-level=\"2\" data-analytics-category=\"Utilities\" data-analytics-text=\"Downloads\" href=\"https://access.redhat.com/downloads/\"\u003e\n Downloads\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli id=\"nav-rh-console\"\u003e\n \u003ca class=\"top-nav-rh-console\" data-analytics-level=\"2\" data-analytics-category=\"Utilities\" data-analytics-text=\"Red Hat Console\" href=\"//console.redhat.com/\"\u003e\n Red Hat Console\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli id=\"nav-support\" data-portal-tour-1=\"3\"\u003e\n \u003ca class=\"top-nav-get-support\" data-analytics-level=\"2\" data-analytics-category=\"Utilities\" data-analytics-text=\"Get Support\" href=\"https://access.redhat.com/support/\"\u003e\n Get Support\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/nav\u003e\n\n \u003cpfe-navigation id=\"pfe-navigation\" data-analytics-region=\"mega menu\"\u003e\n \u003cdiv class=\"pfe-navigation__logo-wrapper\" id=\"pfe-navigation__logo-wrapper\"\u003e\n \u003ca href=\"https://access.redhat.com/\" class=\"pfe-navigation__logo-link\" data-analytics-text=\"logo\" data-analytics-category=\"MM|logo\"\u003e\n \u003cimg class=\"pfe-navigation__logo-image\" alt=\"Red Hat Customer Portal\" src=\"https://access.redhat.com/chrome_themes/nimbus/img/red-hat-customer-portal.svg\" /\u003e\n \u003c/a\u003e\n \u003c/div\u003e\n\n \u003cnav class=\"pfe-navigation\" aria-label=\"Main Navigation\" data-analytics-region=\"main nav\"\u003e\n \u003cul class=\"pfe-navigation__menu\" id=\"pfe-navigation__menu\"\u003e\n\n \n \u003cli class=\"pfe-navigation__menu-item hidden-at-tablet hidden-at-desktop\" id=\"nav-subscription--mobile\" data-portal-tour-1=\"1\"\u003e\n \u003ca class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Subscriptions\" href=\"https://access.redhat.com/management/\"\u003e\n Subscriptions\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli class=\"pfe-navigation__menu-item hidden-at-tablet hidden-at-desktop\" id=\"nav-downloads--mobile\" data-portal-tour-1=\"2\"\u003e\n \u003ca class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Downloads\" href=\"https://access.redhat.com/downloads/\"\u003e\n Downloads\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli class=\"pfe-navigation__menu-item hidden-at-tablet hidden-at-desktop\" id=\"nav-containers--mobile\"\u003e\n \u003ca class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Red Hat Console\" href=\"//console.redhat.com/\"\u003e\n Red Hat Console\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli class=\"pfe-navigation__menu-item hidden-at-tablet hidden-at-desktop\" id=\"nav-support--mobile\" data-portal-tour-1=\"3\"\u003e\n \u003ca class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Get Support\" href=\"https://access.redhat.com/support/\"\u003e\n Get Support\n \u003c/a\u003e\n \u003c/li\u003e\n\n \n \u003cli class=\"pfe-navigation__menu-item\"\u003e\n \u003ca href=\"https://access.redhat.com/\" class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Products\"\u003e\n Products\n \u003c/a\u003e\n \u003cdiv class=\"pfe-navigation__dropdown pfe-navigation__dropdown--3-column pfe-navigation__dropdown--3-column--centered\"\u003e\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__products__top_products\" data-analytics-level=\"2\" data-analytics-text=\"Top Products\" data-analytics-category=\"Top Products\"\u003e\n Top Products\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__products__top_products\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Products\" data-analytics-text=\"Red Hat Enterprise Linux\" href=\"https://access.redhat.com/products/red-hat-enterprise-linux/\"\u003e\n Red Hat Enterprise Linux\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Products\" data-analytics-text=\"Red Hat OpenShift\" href=\"https://access.redhat.com/products/red-hat-openshift-container-platform\"\u003e\n Red Hat OpenShift\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Products\" data-analytics-text=\"Red Hat Ansible Automation Platform\" href=\"https://access.redhat.com/products/red-hat-ansible-automation-platform/\"\u003e\n Red Hat Ansible Automation Platform\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003cpfe-cta\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products\" data-analytics-text=\"All Products\" data-analytics-linkType=\"cta\" href=\"https://access.redhat.com/products/\"\u003e\n All Products\n \u003c/a\u003e\n \u003c/pfe-cta\u003e\n \u003c/div\u003e\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__products__downloads_containers\" data-analytics-level=\"2\" data-analytics-category=\"Products and Services\" data-analytics-text=\"Downloads and Containers\"\u003e\n Downloads and Containers\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__products__downloads_containers\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Downloads and Containers\" data-analytics-text=\"Downloads\" href=\"https://access.redhat.com/downloads/\"\u003e\n Downloads\n \u003c/a\u003e\n \u003c/li\u003e\n\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Downloads and Containers\" data-analytics-text=\"Packages\" href=\"https://access.redhat.com/downloads/content/package-browser\"\u003e\n Packages\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Downloads and Containers\" data-analytics-text=\"Containers\" href=\"https://catalog.redhat.com/software/containers/explore/\"\u003e\n Containers\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__products__top_resources\" data-analytics-level=\"2\" data-analytics-category=\"Top Resources\" data-analytics-text=\"Top Resources\"\u003e\n Top Resources\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__products__top_resources\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Reasources\" data-analytics-text=\"Documentation\" href=\"//docs.redhat.com/\"\u003e\n Documentation\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Resources\" data-analytics-text=\"Product Life Cycles\" href=\"https://access.redhat.com/product-life-cycles/\"\u003e\n Product Life Cycles\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Resources\" data-analytics-text=\"Product Compliance\" href=\"https://access.redhat.com/compliance/\"\u003e\n Product Compliance\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products|Top Resources\" data-analytics-text=\"Errata\" href=\"https://access.redhat.com/errata/\"\u003e\n Errata\n \u003c/a\u003e\n \u003c/li\u003e\n\n \u003c/ul\u003e\n \u003c/div\u003e\n \u003c/div\u003e\n \u003c/li\u003e\n\n \n \u003cli class=\"pfe-navigation__menu-item\"\u003e\n \u003ca class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Knowledge\" href=\"https://access.redhat.com/labs/\"\u003e\n Knowledge\n \u003c/a\u003e\n \u003cdiv class=\"pfe-navigation__dropdown pfe-navigation__dropdown--3-column pfe-navigation__dropdown--3-column--centered\"\u003e\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__knowledge__knowledge_center\" data-analytics-level=\"2\" data-analytics-text=\"Red Hat Knowledge Center\" data-analytics-category=\"Tools\"\u003e\n \u003ca data-analytics-level=\"2\" data-analytics-category=\"Knowledge|Red Hat Knowledge Center\" data-analytics-text=\"Knowledgebase\" href=\"https://access.redhat.com/kb\"\u003e\n Red Hat Knowledge Center\n \u003c/a\u003e\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__knowledge__knowledge_center\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Red Hat Knowledge Center\" data-analytics-text=\"Knowledgebase Solutions\" href=\"https://access.redhat.com/kb/search?document_kinds=Solution\u0026start=0\"\u003e\n Knowledgebase Solutions\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Red Hat Knowledge Center\" data-analytics-text=\"Knowledgebase Articles\" href=\"https://access.redhat.com/kb/search?document_kinds=Article\u0026start=0\"\u003e\n Knowledgebase Articles\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Red Hat Knowledge Center\" data-analytics-text=\"Customer Portal Labs\" href=\"https://access.redhat.com/labs/\"\u003e\n Customer Portal Labs\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Red Hat Knowledge Center\" data-analytics-text=\"Errata\" href=\"https://access.redhat.com/errata/\"\u003e\n Errata\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__knowledge__product_docs\"\u003e\n Top Product Docs\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__knowledge__product_docs\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Top Product Docs\" data-analytics-text=\"Red Hat Enterprise Linux\" href=\"//docs.redhat.com/en/documentation/red_hat_enterprise_linux/\"\u003e\n Red Hat Enterprise Linux\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Top Product Docs\" data-analytics-text=\"Red Hat OpenShift\" href=\"//docs.redhat.com/en/documentation/openshift_container_platform/\"\u003e\n Red Hat OpenShift\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Top Product Docs\" data-analytics-text=\"Red Hat Ansible Automation Platform\" href=\"//docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/\"\u003e\n Red Hat Ansible Automation Platform\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003cpfe-cta\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Top Product Docs\" data-analytics-text=\"All Product Docs\" data-analytics-linkType=\"cta\" href=\"//docs.redhat.com/en/products\"\u003e\n All Product Docs\n \u003c/a\u003e\n \u003c/pfe-cta\u003e\n \u003c/div\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__knowledge__training_certification\"\u003e\n \u003ca data-analytics-level=\"2\" data-analytics-category=\"Tools\" data-analytics-text=\"Training and Certification\" href=\"//www.redhat.com/en/services/training-and-certification\"\u003e\n Training and Certification\n \u003c/a\u003e\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__knowledge__training_certification\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Training and Certification\" data-analytics-text=\"About\" href=\"//www.redhat.com/en/services/training-and-certification\"\u003e\n About\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Training and Certification\" data-analytics-text=\"Course Index\" href=\"//www.redhat.com/en/services/training/all-courses-exams\"\u003e\n Course Index\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Training and Certification\" data-analytics-text=\"Certification Index\" href=\"//www.redhat.com/en/services/certifications\"\u003e\n Certification Index\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Knowledge|Training and Certification\" data-analytics-text=\"Skill Assessment\" href=\"//skills.ole.redhat.com/\"\u003e\n Skill Assessment\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n \u003c/div\u003e\n \u003c/li\u003e\n\n \n \u003cli class=\"pfe-navigation__menu-item\"\u003e\n \u003ca class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Security\" href=\"https://access.redhat.com/security/\"\u003e\n Security\n \u003c/a\u003e\n \u003cdiv class=\"pfe-navigation__dropdown pfe-navigation__dropdown--3-column pfe-navigation__dropdown--3-column--centered\"\u003e\n \n \u003cdiv\u003e\n \u003ch3 id=\"security__security_center\"\u003e\n \u003ca data-analytics-level=\"2\" data-analytics-category=\"Security\" data-analytics-text=\"Red Hat Product Security Center\" href=\"https://access.redhat.com/security\"\u003e\n Red Hat Product Security Center\n \u003c/a\u003e\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"security__security_center\"\u003e\n\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Red Hat Product Security Center\" data-analytics-text=\"Security Updates\" href=\"https://access.redhat.com/security/security-updates/\"\u003e\n Security Updates\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Red Hat Product Security Center\" data-analytics-text=\"Security Advisories\" href=\"https://access.redhat.com/security/security-updates/#/security-advisories\"\u003e\n Security Advisories\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Red Hat Product Security Center\" data-analytics-text=\"Red Hat CVE Database\" href=\"https://access.redhat.com/security/security-updates/#/cve\"\u003e\n Red Hat CVE Database\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Red Hat Product Security Center\" data-analytics-text=\"Errata\" href=\"https://access.redhat.com/errata/\"\u003e\n Errata\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__security__references\" data-analytics-level=\"2\" data-analytics-text=\"References\" data-analytics-category=\"Security\"\u003e\n References\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__security__references\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|References\" data-analytics-text=\"Security Bulletins\" href=\"https://access.redhat.com/security/vulnerabilities\"\u003e\n Security Bulletins\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Red Hat Product Security Center\" data-analytics-text=\"Severity Ratings\" href=\"https://access.redhat.com/security/updates/classification/\"\u003e\n Severity Ratings\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|References\" data-analytics-text=\"Security Data\" href=\"https://access.redhat.com/security/data\"\u003e\n Security Data\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__security__top_resources\"\u003e\n Top Resources\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__security__top_resources\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Top Resources\" data-analytics-text=\"Security Labs\" href=\"https://access.redhat.com/security/security-updates/#/security-labs\"\u003e\n Security Labs\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Top Resources\" data-analytics-text=\"Backporting Policies\" href=\"https://access.redhat.com/security/updates/backporting/\"\u003e\n Backporting Policies\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Security|Top Resources\" data-analytics-text=\"Security Blog\" href=\"//redhat.com/en/blog/channel/security\"\u003e\n Security Blog\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \u003c/div\u003e\n \u003c/li\u003e\n\n \n \u003cli class=\"pfe-navigation__menu-item\"\u003e\n \u003ca href=\"https://access.redhat.com/support/\" class=\"pfe-navigation__menu-link\" data-analytics-level=\"1\" data-analytics-text=\"Support\"\u003e\n Support\n \u003c/a\u003e\n \u003cdiv class=\"pfe-navigation__dropdown pfe-navigation__dropdown--3-column pfe-navigation__dropdown--3-column--centered\"\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__support__rh_support\"\u003e\n \u003ca href=\"https://access.redhat.com/support/\" data-analytics-level=\"2\" data-analytics-text=\"Red Hat Support\" data-analytics-category=\"Support\"\u003e\n Red Hat Support\n \u003c/a\u003e\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__support__rh_support\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Support\" data-analytics-text=\"Support Cases\" href=\"https://access.redhat.com/support/cases/\"\u003e\n Support Cases\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Support\" data-analytics-text=\"Troubleshoot\" href=\"https://access.redhat.com/support/cases/#/troubleshoot\"\u003e\n Troubleshoot\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Support\" data-analytics-text=\"Get Support\" href=\"https://access.redhat.com/support/\"\u003e\n Get Support\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Support\" data-analytics-text=\"Contact Red Hat Support\" href=\"https://access.redhat.com/support/contact/\"\u003e\n Contact Red Hat Support\n \u003c/a\u003e\n \u003c/li\u003e\n\n \u003c/ul\u003e\n\n \u003c/div\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__support__community_support\"\u003e\n \u003ca href=\"https://access.redhat.com/community\" data-analytics-level=\"2\" data-analytics-text=\"Red Hat Community Support\" data-analytics-category=\"Support\"\u003e\n Red Hat Community Support\n \u003c/a\u003e\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__support__community_support\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Community Support\" data-analytics-text=\"Customer Portal Community\" href=\"https://access.redhat.com/community/\"\u003e\n Customer Portal Community\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Community Support\" data-analytics-text=\"Community Discussions\" href=\"https://access.redhat.com/discussions/\"\u003e\n Community Discussions\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Community Support\" data-analytics-text=\"Red Hat Accelerator Program\" href=\"https://access.redhat.com/accelerators/\"\u003e\n Red Hat Accelerator Program\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c!-- commented out because the accelerator program link will likely be replaced by \"Contribute\" in the future. Translation strings are already in place so uncommenting this link is all that will be needed\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Red Hat Community Support\" data-analytics-text=\"Contribute\" href=\"https://access.redhat.com/\"\u003e\n Contribute\n \u003c/a\u003e\n \u003c/li\u003e --\u003e\n\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \n \u003cdiv\u003e\n \u003ch3 id=\"nav__support__top_resources\" data-analytics-level=\"2\" data-analytics-text=\"Top Resources\" data-analytics-category=\"Support\"\u003e\n Top Resources\n \u003c/h3\u003e\n \u003cul aria-labelledby=\"nav__support__top_resources\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Top Resources\" data-analytics-text=\"Product Life Cycles\" href=\"https://access.redhat.com/product-life-cycles/\"\u003e\n Product Life Cycles\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Top Resources\" data-analytics-text=\"Customer Portal Labs\" href=\"https://access.redhat.com/labs/\"\u003e\n Customer Portal Labs\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Top Resources\" data-analytics-text=\"Red Hat JBoss Supported Configurations\" href=\"https://access.redhat.com/support/configurations/jboss\"\u003e\n Red Hat JBoss Supported Configurations\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Support|Top Resources\" data-analytics-text=\"Red Hat Lightspeed\" href=\"https://cloud.redhat.com/insights\"\u003e\n Red Hat Lightspeed\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n \u003c/div\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n\n\n\n \n \n \n \u003c/nav\u003e\n\n \n \u003cdiv id=\"site-search\" slot=\"search\" class=\"utility-link site-search\"\u003e\n \u003cdiv class=\"content\"\u003e\n \u003cform class=\"ng-pristine ng-valid topSearchForm\" id=\"topSearchForm\" name=\"topSearchForm\" action=\"/search/browse/search/\" method=\"get\" enctype=\"application/x-www-form-urlencoded\"\u003e\n \u003ccp-search-autocomplete class=\"push-bottom\" path=\"/webassets/avalon/j/data.json\"\u003e\u003c/cp-search-autocomplete\u003e\n \n \u003cdiv\u003e\n Or \u003ca href=\"/support/cases/#/troubleshoot\"\u003etroubleshoot an issue\u003c/a\u003e.\n \u003c/div\u003e\n \u003c/form\u003e\n \u003c/div\u003e\n \u003c/div\u003e\n\n \u003cdiv id=\"ask-red-hat\" slot=\"event\"\u003e\n \u003ccp-ask-red-hat data-analytics-category=\"RHCP|HP|Navigation|Authenticated|Subs\" data-analytics-text=\"Ask Red Hat\" data-analytics-linktype=\"cta\"\u003e\u003c/cp-ask-red-hat\u003e\n \u003c/div\u003e\n\n \u003cdiv slot=\"secondary-links\" id=\"localesMenu\"\u003e\n \u003cbutton class=\"pfe-navigation__secondary-link\"\u003e\n \u003cpfe-icon icon=\"web-icon-globe\" size=\"sm\" aria-hidden=\"true\"\u003e\u003c/pfe-icon\u003e\n English\n \u003c/button\u003e\n\n \u003cpfe-navigation-dropdown dropdown-width=\"single\"\u003e\n \u003ch2 class=\"utility-header\"\u003e\n Select Your Language\n \u003c/h2\u003e\n \u003cul class=\"reset\"\u003e\n \u003cli\u003e\u003ca href=\"#\" data-lang=\"en\" id=\"en\" data-analytics-text=\"English\"\u003eEnglish\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"#\" data-lang=\"fr\" id=\"fr\" data-analytics-text=\"French\"\u003eFrançais\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"#\" data-lang=\"ko\" id=\"ko\" data-analytics-text=\"Korean\"\u003e한국어\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"#\" data-lang=\"ja\" id=\"ja\" data-analytics-text=\"Japanese\"\u003e日本語\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"#\" data-lang=\"zh_CN\" id=\"zh_CN\" data-analytics-text=\"Chinese\"\u003e中文 (中国)\u003c/a\u003e\u003c/li\u003e\n \u003c/ul\u003e\n\n \u003c/pfe-navigation-dropdown\u003e\n \u003c/div\u003e\n\n \n \u003crh-account-dropdown slot=\"account\"\u003e\u003c/rh-account-dropdown\u003e\n\n \n \u003cpfe-primary-detail breakpoint-width=\"600\" class=\"main-menu__dropdown--product__product-listing\" slot=\"main-menu__dropdown--product__product-listing\" consistent-height\u003e\n \u003ch3 slot=\"details-nav\"\u003e\n \n Infrastructure and Management\n \n \u003c/h3\u003e\n \u003cdiv slot=\"details\"\u003e\n \u003cul\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Infrastructure and Management\" data-analytics-text=\"Red Hat Enterprise Linux\" href=\"https://access.redhat.com/products/red-hat-enterprise-linux/\"\u003e\n Red Hat Enterprise Linux\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Infrastructure and Management\" data-analytics-text=\"Red Hat Satellite\" href=\"https://access.redhat.com/products/red-hat-satellite/\"\u003e\n Red Hat Satellite\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Infrastructure and Management\" data-analytics-text=\"Red Hat Subscription Management\" href=\"https://access.redhat.com/products/red-hat-subscription-management/\"\u003e\n Red Hat Subscription Management\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Infrastructure and Management\" data-analytics-text=\"Red Hat Lightspeed\" href=\"https://access.redhat.com/products/red-hat-insights/\"\u003e\n Red Hat Lightspeed\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Infrastructure and Management\" data-analytics-text=\"Red Hat Ansible Automation Platform\" href=\"https://access.redhat.com/products/red-hat-ansible-automation-platform/\"\u003e\n Red Hat Ansible Automation Platform\n \u003c/a\u003e\u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \u003ch3 slot=\"details-nav\"\u003e\n \n Cloud Computing\n \n \u003c/h3\u003e\n \u003cdiv slot=\"details\"\u003e\n \u003cul\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat OpenShift\" href=\"https://access.redhat.com/products/red-hat-openshift-container-platform\"\u003e\n Red Hat OpenShift\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat OpenStack Platform\" href=\"https://access.redhat.com/products/red-hat-openstack-platform/\"\u003e\n Red Hat OpenStack Platform\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing Platform\" data-analytics-text=\"Red Hat OpenShift Container Platform\" href=\"https://access.redhat.com/products/red-hat-openshift-container-platform/\"\u003e\n Red Hat OpenShift\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing Platform\" data-analytics-text=\"Red Hat OpenShift AI\" href=\"https://access.redhat.com/products/red-hat-openshift-ai/\"\u003e\n Red Hat OpenShift AI\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat OpenShift Dedicated\" href=\"https://access.redhat.com/products/openshift-dedicated-red-hat/\"\u003e\n Red Hat OpenShift Dedicated\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing Platform\" data-analytics-text=\"Red Hat Advanced Cluster Security for Kubernetes\" href=\"https://access.redhat.com/products/red-hat-advanced-cluster-security-for-kubernetes/\"\u003e\n Red Hat Advanced Cluster Security for Kubernetes\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat Advanced Cluster Management for Kubernetes\" href=\"https://access.redhat.com/products/red-hat-advanced-cluster-management-for-kubernetes/\"\u003e\n Red Hat Advanced Cluster Management for Kubernetes\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat Quay\" href=\"https://access.redhat.com/products/red-hat-quay/\"\u003e\n Red Hat Quay\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat OpensShift Dev Spaces\" href=\"https://access.redhat.com/products/red-hat-openshift-dev-spaces\"\u003e\n Red Hat OpenShift Dev Spaces\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Cloud Computing\" data-analytics-text=\"Red Hat OpenShift Service on AWS\" href=\"https://access.redhat.com/products/red-hat-openshift-service-aws\"\u003e\n Red Hat OpenShift Service on AWS\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \u003ch3 slot=\"details-nav\"\u003e\n \n Storage\n \n \u003c/h3\u003e\n \u003cdiv slot=\"details\"\u003e\n \u003cul\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Storage\" data-analytics-text=\"Red Hat Gluster Storage\" href=\"https://access.redhat.com/products/red-hat-storage/\"\u003e\n Red Hat Gluster Storage\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Storage\" data-analytics-text=\"Red Hat Hyperconverged Infrastructure\" href=\"https://access.redhat.com/products/red-hat-hyperconverged-infrastructure/\"\u003e\n Red Hat Hyperconverged Infrastructure\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Storage\" data-analytics-text=\"Red Hat Ceph Storage\" href=\"https://access.redhat.com/products/red-hat-ceph-storage/\"\u003e\n Red Hat Ceph Storage\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Storage\" data-analytics-text=\"Red Hat Openshift Container Storage\" href=\"https://access.redhat.com/products/red-hat-openshift-data-foundation\"\u003e\n Red Hat OpenShift Data Foundation\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \u003ch3 slot=\"details-nav\"\u003e\n \n Runtimes\n \n \u003c/h3\u003e\n \u003cdiv slot=\"details\"\u003e\n \u003cul\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat Runtimes\" href=\"https://access.redhat.com/products/red-hat-runtimes/\"\u003e\n Red Hat Runtimes\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat JBoss Enterprise Application Platform\" href=\"https://access.redhat.com/products/red-hat-jboss-enterprise-application-platform/\"\u003e\n Red Hat JBoss Enterprise Application Platform\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat Data Grid\" href=\"https://access.redhat.com/products/red-hat-data-grid/\"\u003e\n Red Hat Data Grid\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat JBoss Web Server\" href=\"https://access.redhat.com/products/red-hat-jboss-web-server/\"\u003e\n Red Hat JBoss Web Server\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat build of Keycloak\" href=\"https://access.redhat.com/products/red-hat-build-of-keycloak/\"\u003e\n Red Hat build of Keycloak\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat support for Spring Boot\" href=\"https://access.redhat.com/products/spring-boot/\"\u003e\n Red Hat support for Spring Boot\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat build of Node.js\" href=\"https://access.redhat.com/products/nodejs/\"\u003e\n Red Hat build of Node.js\n \u003c/a\u003e\n \u003c/li\u003e\n \n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Runtimes\" data-analytics-text=\"Red Hat build of Quarkus\" href=\"https://access.redhat.com/products/quarkus/\"\u003e\n Red Hat build of Quarkus\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n\n \u003ch3 slot=\"details-nav\"\u003e\n \n Integration and Automation\n \n \u003c/h3\u003e\n \u003cdiv slot=\"details\"\u003e\n \u003cul class=\"border-bottom\" id=\"portal-menu-border-bottom\"\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Integration and Automation\" data-analytics-text=\"Red Hat Application Foundations\" href=\"https://access.redhat.com/products/red-hat-application-foundations/\"\u003e\n Red Hat Application Foundations\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Integration and Automation\" data-analytics-text=\"Red Hat Fuse\" href=\"https://access.redhat.com/products/red-hat-fuse/\"\u003e\n Red Hat Fuse\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Integration and Automation\" data-analytics-text=\"Red Hat AMQ\" href=\"https://access.redhat.com/products/red-hat-amq/\"\u003e\n Red Hat AMQ\n \u003c/a\u003e\n \u003c/li\u003e\n \u003cli\u003e\n \u003ca data-analytics-level=\"3\" data-analytics-category=\"Products and Services|Products:Integration and Automation\" data-analytics-text=\"Red Hat 3scale API Management\" href=\"https://access.redhat.com/products/red-hat-3scale/\"\u003e\n Red Hat 3scale API Management\n \u003c/a\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/div\u003e\n \u003cdiv slot=\"details-nav--footer\"\u003e\n \u003cpfe-cta pfe-priority=\"primary\"\u003e\n \u003ca href=\"https://access.redhat.com/products/\" class=\"pfe-navigation__menu-link\" data-analytics-level=\"2\" data-analytics-text=\"All Products\" data-analytics-category=\"Products and Services|Products:\" data-analytics-linkType=\"cta\"\u003e\n All Products\n \u003c/a\u003e\n \u003c/pfe-cta\u003e\n \u003c/div\u003e\n \u003c/pfe-primary-detail\u003e\n\n \u003c/pfe-navigation\u003e\n\n \u003cdiv id=\"scroll-anchor\"\u003e\u003c/div\u003e\n\n \u003c!--[if IE 8]\u003e\n \u003cdiv class=\"portal-messages\"\u003e\n \u003cdiv class=\"alert alert-warning alert-portal alert-w-icon\"\u003e\n \u003cspan class=\"icon-warning alert-icon\" aria-hidden=\"true\"\u003e\u003c/span\u003e\n You are using an unsupported web browser. Update to a supported browser for the best experience. \u003ca href=\"https://access.redhat.com/announcements/2120951\"\u003eRead the announcement\u003c/a\u003e.\n \u003c/div\u003e\n \u003c/div\u003e\n \u003c![endif]--\u003e\n \u003c!--[if IE 9]\u003e\n \u003cdiv class=\"portal-messages\"\u003e\n \u003cdiv class=\"alert alert-warning alert-portal alert-w-icon\"\u003e\n \u003cspan class=\"icon-warning alert-icon\" aria-hidden=\"true\"\u003e\u003c/span\u003e\n As of March 1, 2016, the Red Hat Customer Portal will no longer support Internet Explorer 9. See our new \u003ca href=\"/help/browsers\"\u003ebrowser support policy\u003c/a\u003e for more information.\n \u003c/div\u003e\n \u003c/div\u003e\n \u003c![endif]--\u003e\n \u003cdiv id=\"site-section\"\u003e\u003c/div\u003e\n \u003c/header\u003e\n \u003c!--googleon: all--\u003e\n\n \u003c/div\u003e\n\u003c!-- /CP_PRIMER_HEADER --\u003e"])</script><script>self.__next_f.push([1,"5:[[[\"$\",\"meta\",\"primer-head-meta-0\",{\"suppressHydrationWarning\":true,\"httpEquiv\":\"X-UA-Compatible\",\"content\":\"IE=edge\"}],[\"$\",\"meta\",\"primer-head-meta-1\",{\"suppressHydrationWarning\":true,\"name\":\"theme-color\",\"content\":\"#000000\"}],[\"$\",\"meta\",\"primer-head-meta-2\",{\"suppressHydrationWarning\":true,\"name\":\"msapplication-navbutton-color\",\"content\":\"#000000\"}],[\"$\",\"meta\",\"primer-head-meta-3\",{\"suppressHydrationWarning\":true,\"name\":\"apple-mobile-web-app-status-bar-style\",\"content\":\"#000000\"}],[\"$\",\"link\",\"primer-head-link-4\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://www.redhatstatic.com/dssf-001/v1-alpha/@rhds/elements@1.4.1/elements/rh-footer/rh-footer-lightdom.css\"}],[\"$\",\"link\",\"primer-head-link-5\",{\"suppressHydrationWarning\":true,\"rel\":\"preconnect\",\"href\":\"https://static.redhat.com\"}],[\"$\",\"link\",\"primer-head-link-6\",{\"suppressHydrationWarning\":true,\"rel\":\"preconnect\",\"href\":\"https://consent.trustarc.com\"}],[\"$\",\"style\",\"primer-head-style-7\",{\"suppressHydrationWarning\":true,\"type\":\"text/css\",\"media\":\"screen\",\"dangerouslySetInnerHTML\":{\"__html\":\"body::before{content:\\\"CRITICAL CSS\\\"}\"}}],[\"$\",\"link\",\"primer-head-link-8\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/css/bootstrap.css\"}],[\"$\",\"link\",\"primer-head-link-9\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/css/bootstrap-grid.css\"}],[\"$\",\"link\",\"primer-head-link-10\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/css/main.css\"}],[\"$\",\"link\",\"primer-head-link-11\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/css/components.css\"}],[\"$\",\"link\",\"primer-head-link-12\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/css/pages.css\"}],[\"$\",\"link\",\"primer-head-link-13\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/css/cphub-alerts.css\"}],[\"$\",\"link\",\"primer-head-link-14\",{\"suppressHydrationWarning\":true,\"media\":\"all\",\"rel\":\"stylesheet\",\"href\":\"https://access.redhat.com/services/primer/js/primer.css\"}]],[\"$\",\"div\",null,{\"id\":\"page-wrap\",\"className\":\"page-wrap\",\"children\":[[\"$\",\"div\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"$2b\"},\"suppressHydrationWarning\":true}],\"$L2c\",\"$L2d\"]}],\"$L2e\"]\n"])</script><script>self.__next_f.push([1,"31:I[44335,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"450\",\"static/chunks/app/%5Blocale%5D/layout-fc4463590c5a54e3.js\"],\"PrimerScripts\"]\n2c:[\"$\",\"main\",null,{\"id\":\"cp-main\",\"className\":\"portal-content-area\",\"children\":\"$L2f\"}]\n30:T2a6b,"])</script><script>self.__next_f.push([1,"\u003c!-- CP_PRIMER_FOOTER --\u003e\n\u003crh-footer color-palette=\"darker\"\u003e\n\n \u003ca slot=\"logo\" href=\"https://redhat.com/en\"\u003e\n \u003cimg alt=\"Red Hat\" src=\"https://static.redhat.com/libs/redhat/brand-assets/2/corp/logo--on-dark.svg\" loading=\"lazy\" /\u003e\n \u003c/a\u003e\n\n \u003crh-footer-social-link slot=\"social-links\" icon=\"linkedin\"\u003e\n\n \u003ca href=\"https://www.linkedin.com/company/red-hat\" data-analytics-region=\"social-links-exit\" data-analytics-category=\"Footer|social-links\" data-analytics-text=\"LinkedIn\"\u003e\n \u003cspan class=\"sr-only\"\u003eLinkedIn\u003c/span\u003e\n \u003csvg class=\"social-icons\" aria-hidden=\"true\" focusable=\"false\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 30 30\"\u003e\u003cpath d=\"M9.27 24.35h-4.3V10.52h4.3v13.83zM7.12 8.63a2.49 2.49 0 1 1 2.49-2.49 2.48 2.48 0 0 1-2.49 2.49Zm18.25 15.72h-4.29v-6.72C21.08 16 21 14 18.84 14s-2.58 1.75-2.58 3.55v6.84H12V10.52h4.12v1.89h.06a4.53 4.53 0 0 1 4.07-2.23c4.35 0 5.15 2.86 5.15 6.59v7.58Z\"\u003e\u003c/path\u003e\u003c/svg\u003e\n \u003c/a\u003e\n\n \u003c/rh-footer-social-link\u003e\n\n \u003crh-footer-social-link slot=\"social-links\" icon=\"youtube\"\u003e\n\n \u003ca href=\"https://www.youtube.com/user/RedHatVideos\" data-analytics-region=\"social-links-exit\" data-analytics-category=\"Footer|social-links\" data-analytics-text=\"YouTube\"\u003e\n \u003cspan class=\"sr-only\"\u003eYouTube\u003c/span\u003e\n \u003csvg class=\"social-icons\" aria-hidden=\"true\" focusable=\"false\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 30 30\"\u003e\u003cpath d=\"M12.68 17.92V11.6l6.07 3.17-6.07 3.15ZM26 10.5a4.82 4.82 0 0 0-.9-2.23 3.21 3.21 0 0 0-2.25-.95C19.73 7.09 15 7.09 15 7.09s-4.72 0-7.87.23a3.21 3.21 0 0 0-2.25.95A4.82 4.82 0 0 0 4 10.5a34.76 34.76 0 0 0-.22 3.64v1.71A34.76 34.76 0 0 0 4 19.49a4.82 4.82 0 0 0 .9 2.23 3.74 3.74 0 0 0 2.47 1c1.8.17 7.65.23 7.65.23s4.73 0 7.87-.24a3.17 3.17 0 0 0 2.25-1 4.82 4.82 0 0 0 .9-2.23 34.76 34.76 0 0 0 .22-3.64v-1.7A34.76 34.76 0 0 0 26 10.5Z\"\u003e\u003c/path\u003e\u003c/svg\u003e\n \u003c/a\u003e\n\n \u003c/rh-footer-social-link\u003e\n\n \u003crh-footer-social-link slot=\"social-links\" icon=\"facebook\"\u003e\n\n \u003ca href=\"https://www.facebook.com/RedHat\" data-analytics-region=\"social-links-exit\" data-analytics-category=\"Footer|social-links\" data-analytics-text=\"Facebook\"\u003e\n \u003cspan class=\"sr-only\"\u003eFacebook\u003c/span\u003e\n \u003csvg class=\"social-icons\" aria-hidden=\"true\" focusable=\"false\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 30 30\"\u003e\u003cpath d=\"M25.93 15.07a10.93 10.93 0 1 0-12.64 10.8v-7.64h-2.77v-3.16h2.77v-2.41c0-2.74 1.63-4.26 4.13-4.26a16.32 16.32 0 0 1 2.45.22v2.69h-1.38A1.58 1.58 0 0 0 16.71 13v2.05h3l-.48 3.16h-2.52v7.64a10.94 10.94 0 0 0 9.22-10.8Z\"\u003e\u003c/path\u003e\u003c/svg\u003e\n \u003c/a\u003e\n\n \u003c/rh-footer-social-link\u003e\n\n \u003crh-footer-social-link slot=\"social-links\" icon=\"twitter\"\u003e\n\n \u003ca href=\"https://x.com/RedHat\" data-analytics-region=\"social-links-exit\" data-analytics-category=\"Footer|social-links\" data-analytics-text=\"Twitter\"\u003e\n \u003cspan class=\"sr-only\"\u003eX, formerly Twitter\u003c/span\u003e\n \u003csvg class=\"social-icons\" aria-hidden=\"true\" focusable=\"false\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 30 30\"\u003e\u003cpath d=\"m16.78 13.54 6.96-8.09h-1.65l-6.04 7.02-4.82-7.02H5.67l7.3 10.62-7.3 8.48h1.65l6.38-7.42 5.1 7.42h5.56l-7.57-11.01Zm-2.26 2.62-.74-1.06L7.9 6.69h2.53l4.75 6.79.74 1.06 6.17 8.83h-2.53l-5.03-7.2Z\"\u003e\u003c/path\u003e\u003c/svg\u003e\n \u003c/a\u003e\n\n \u003c/rh-footer-social-link\u003e\n\n \u003ch3 slot=\"links\"\u003eQuick Links\u003c/h3\u003e\n\n \u003cul slot=\"links\"\u003e\n \u003cli\u003e\u003ca class=\"download-software\" href=\"https://access.redhat.com/downloads/\"\u003eDownloads\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"manage-subscriptions\" href=\"https://access.redhat.com/management\"\u003eSubscriptions\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"support-cases\" href=\"https://access.redhat.com/support\"\u003eSupport Cases\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"customer-service\" href=\"https://access.redhat.com/support/customer-service\"\u003eCustomer Service\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"quick-docs\" href=\"//docs.redhat.com/\"\u003eProduct Documentation\u003c/a\u003e\u003c/li\u003e\n \u003c/ul\u003e\n\n \u003ch3 slot=\"links\"\u003eHelp\u003c/h3\u003e\n\n \u003cul slot=\"links\"\u003e\n \u003cli\u003e\u003ca class=\"contact-us\" href=\"https://access.redhat.com/support/contact/\"\u003eContact Us\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"cp-faqs\" href=\"https://access.redhat.com/articles/33844\"\u003eCustomer Portal FAQ\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"login-problems\" href=\"https://access.redhat.com/help/login_assistance\"\u003eLog-in Assistance\u003c/a\u003e\u003c/li\u003e\n \u003c/ul\u003e\n\n \u003ch3 slot=\"links\"\u003eSite Info\u003c/h3\u003e\n\n \u003cul slot=\"links\"\u003e\n \u003cli\u003e\u003ca class=\"trust-red-hat\" href=\"https://www.redhat.com/en/trust\"\u003eTrust Red Hat\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"browser-support-policy\" href=\"https://www.redhat.com/en/about/browser-support\"\u003eBrowser Support Policy\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"accessibility\" href=\"https://www.redhat.com/en/about/digital-accessibility\"\u003eAccessibility\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"recognition\" href=\"https://access.redhat.com/recognition/\"\u003eAwards and Recognition\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca class=\"colophon\" href=\"https://access.redhat.com/help/colophon/\"\u003eColophon\u003c/a\u003e\u003c/li\u003e\n \u003c/ul\u003e\n\n \u003ch3 slot=\"links\"\u003eRelated Sites\u003c/h3\u003e\n\n \u003cul slot=\"links\"\u003e\n \u003cli\u003e\u003ca href=\"https://www.redhat.com/\" class=\"red-hat-com\"\u003eredhat.com\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"http://developers.redhat.com/\" class=\"red-hat-developers\"\u003edevelopers.redhat.com\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"https://connect.redhat.com/\" class=\"partner-connect\"\u003econnect.redhat.com\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"https://cloud.redhat.com/\" class=\"cloud-com\"\u003ecloud.redhat.com\u003c/a\u003e\u003c/li\u003e\n \u003c/ul\u003e\n\n \u003c!-- Temporary location of site status component until a slot is added for it in rh-footer --\u003e\n \u003cdiv class=\"site-status-container\" slot=\"universal\"\u003e\n \u003c!-- Site Status--\u003e\n \u003crh-site-status\u003e\u003c/rh-site-status\u003e\n \u003c/div\u003e\n\n \u003c!-- Universal Footer --\u003e\n \u003crh-footer-universal slot=\"universal\"\u003e\n \u003ch3 slot=\"links-primary\" data-analytics-text=\"Red Hat legal and privacy links\" hidden\u003eRed Hat legal and privacy\n links\u003c/h3\u003e\n\n \u003cul slot=\"links-primary\" data-analytics-region=\"page-footer-bottom-primary\"\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/about/company\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"About Red Hat\"\u003eAbout Red Hat\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/jobs\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Jobs\"\u003eJobs\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/events\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Events\"\u003eEvents\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/about/office-locations\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Locations\"\u003eLocations\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/contact\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Contact Red Hat\"\u003eContact Red Hat\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/blog\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Red Hat Blog\"\u003eRed Hat Blog\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://www.redhat.com/en/about/our-culture/inclusion\"\n data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Inclusion at Red Hat\"\u003eInclusion at Red Hat\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://coolstuff.redhat.com/\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Cool Stuff Store\"\u003eCool Stuff Store\u003c/a\u003e\u003c/li\u003e\n\n \u003cli\u003e\u003ca href=\"https://www.redhat.com/en/summit\" data-analytics-category=\"Footer|Corporate\"\n data-analytics-text=\"Red Hat Summit\"\u003eRed Hat Summit\u003c/a\u003e\u003c/li\u003e\n\n \u003c/ul\u003e\n\n \u003crh-footer-copyright slot=\"links-secondary\"\u003e © 2026 Red Hat\u003c/rh-footer-copyright\u003e\n\n \u003ch3 slot=\"links-secondary\" data-analytics-text=\"Red Hat legal and privacy links\" hidden\u003eRed Hat legal and\n privacy links\u003c/h3\u003e\n\n \u003cul slot=\"links-secondary\" data-analytics-region=\"page-footer-bottom-secondary\"\u003e\n\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/about/privacy-policy\"\n data-analytics-category=\"Footer|Red Hat legal and privacy links\"\n data-analytics-text=\"Privacy statement\"\u003ePrivacy statement\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/about/terms-use\"\n data-analytics-category=\"Footer|Red Hat legal and privacy links\"\n data-analytics-text=\"Terms of use\"\u003eTerms of use\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/about/all-policies-guidelines\"\n data-analytics-category=\"Footer|Red Hat legal and privacy links\"\n data-analytics-text=\"All policies and guidelines\"\u003eAll policies and guidelines\u003c/a\u003e\u003c/li\u003e\n \u003cli\u003e\u003ca href=\"https://redhat.com/en/about/digital-accessibility\"\n data-analytics-category=\"Footer|Red Hat legal and privacy links\"\n data-analytics-text=\"Digital accessibility\" class=\"active\"\u003eDigital accessibility\u003c/a\u003e\u003c/li\u003e\n \u003c!-- If your website supports trustarc include this item to add Cookie Preferences to your site. --\u003e\n \u003c!-- TrustArc --\u003e\n \u003cli\u003e\u003cspan id=\"teconsent\"\u003e\u003c/span\u003e\u003c/li\u003e\n\n \u003c/ul\u003e\n \u003c/rh-footer-universal\u003e\n \u003c/rh-footer\u003e\n\n \u003c!--googleoff: all--\u003e\n \u003cnav id=\"to-top\" aria-label=\"Back to Top\"\u003e\n \u003ca class=\"btn_slideto\" href=\"#masthead\" aria-labelledby=\"to-top\"\u003e\n \u003cspan class=\"web-icon-upload\" aria-hidden=\"true\"\u003e\u003c/span\u003e\n \u003c/a\u003e\n \u003c/nav\u003e\n \u003c!-- TrustArc --\u003e\n \u003cdiv id=\"consent_blackbar\"\u003e\u003c/div\u003e\n \u003c!--googleon: all--\u003e\n \u003c!-- /CP_PRIMER_FOOTER --\u003e"])</script><script>self.__next_f.push([1,"2d:[\"$\",\"div\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"$30\"},\"suppressHydrationWarning\":true}]\n32:T573,"])</script><script>self.__next_f.push([1,"window.portal = {\n \n host : \"https://access.redhat.com\",\n idp_url : \"https://sso.redhat.com\",\n \n env : \"prod\",\n lang : \"en\",\n version : \"1.5.24\",\n builddate : \"Thu Jul 09 2026 13:22:49 GMT+0000 (Coordinated Universal Time)\",\n deploydate : \"Thursday, 09-Jul-2026 13:22:58 UTC\",\n fetchdate : \"Sunday, 13-Sep-2026 06:11:35 UTC\",\n primer : {}\n };\n var w=Object.defineProperty;var a=(t,e)=\u003e()=\u003e(t\u0026\u0026(e=t(t=0)),e);var u=(t,e)=\u003e{for(var r in e)w(t,r,{get:e[r],enumerable:!0})};var o=a(()=\u003e{});var i=a(()=\u003e{o()});var l={};u(l,{loginIfSessionExists:()=\u003e_});function _(){let t=!/\\/logout.*/.test(location.pathname),e=window.portal.host===location.origin,r=document.cookie.indexOf(\"rh_sso_session\")\u003e=0,p=!(document.cookie.indexOf(\"rh_jwt\")\u003e=0);if(t\u0026\u0026e\u0026\u0026r\u0026\u0026p){let m=encodeURIComponent(window.location.href);window.location.assign(`/login?redirectTo=${m}`)}}var c=a(()=\u003e{o();i()});o();o();i();var f=\"cp_primer_global_ready\",h=!1;function s(){return new Promise(t=\u003e{h?t(window.portal.primer):window.addEventListener(f,()=\u003e{t(window.portal.primer)})})}o();var d=!0;i();window.portal.primer.onReady=s;d\u0026\u0026Promise.resolve().then(()=\u003e(c(),l)).then(({loginIfSessionExists:t})=\u003e{t()});document.documentElement.setAttribute(\"lang\",document.documentElement.getAttribute(\"lang\")||window.portal.lang||\"en\");"])</script><script>self.__next_f.push([1,"2e:[\"$\",\"$L31\",null,{\"scripts\":[{\"id\":\"primer-script-0\",\"kind\":\"inline\",\"code\":\"if (!HTMLScriptElement.supports || !HTMLScriptElement.supports('importmap')) {\\n import(\\\"https://www.redhatstatic.com/dssf-001/v1-alpha/es-module-shims@1.7.3.js\\\");\\n }\",\"type\":\"$undefined\",\"async\":true},{\"id\":\"primer-script-1\",\"kind\":\"inline\",\"code\":\"{\\n \\\"imports\\\": {\\n \\\"@patternfly/elements/\\\" : \\\"https://www.redhatstatic.com/dssf-001/v1-alpha/@patternfly/elements@2.2.2/\\\",\\n \\\"@patternfly/icons/\\\": \\\"https://www.redhatstatic.com/dssf-001/v1-alpha/@patternfly/icons@1.0.2/\\\",\\n \\\"@rhds/elements/\\\":\\\"https://www.redhatstatic.com/dssf-001/v1-alpha/@rhds/elements@1.4.1/elements/\\\",\\n \\\"@rhds/elements/lib/\\\":\\\"https://www.redhatstatic.com/dssf-001/v1-alpha/@rhds/elements@1.4.1/lib/\\\"\\n }\\n }\",\"type\":\"importmap\",\"async\":false},{\"id\":\"primer-script-2\",\"kind\":\"src\",\"src\":\"https://static.redhat.com/libs/redhat/marketing/latest/trustarc/trustarc.js\",\"type\":\"$undefined\",\"async\":true,\"crossOrigin\":\"$undefined\"},{\"id\":\"primer-script-3\",\"kind\":\"src\",\"src\":\"//www.redhat.com/ma/dpal.js\",\"type\":\"$undefined\",\"async\":true,\"crossOrigin\":\"$undefined\"},{\"id\":\"primer-script-4\",\"kind\":\"inline\",\"code\":\"$32\",\"type\":\"text/javascript\",\"async\":false},{\"id\":\"primer-script-5\",\"kind\":\"src\",\"src\":\"https://access.redhat.com/services/primer/js/primer.js\",\"type\":\"module\",\"async\":false,\"crossOrigin\":\"anonymous\"},{\"id\":\"primer-script-6\",\"kind\":\"inline\",\"code\":\"import 'https://www.redhatstatic.com/dssf-001/v1-alpha/@rhds/elements@1.4.1/elements/rh-footer/rh-footer.js';\",\"type\":\"module\",\"async\":false},{\"id\":\"primer-script-7\",\"kind\":\"inline\",\"code\":\"import 'https://www.redhatstatic.com/dssf-001/v1-alpha/@rhds/elements@1.4.1/elements/rh-site-status/rh-site-status.js';\",\"type\":\"module\",\"async\":false},{\"id\":\"primer-script-8\",\"kind\":\"inline\",\"code\":\"import '@rhds/elements/rh-alert/rh-alert.js';\",\"type\":\"module\",\"async\":false},{\"id\":\"primer-script-9\",\"kind\":\"inline\",\"code\":\"const primer = await window.portal.primer.onReady();\\n const comp = await primer.components.include('cp-ask-red-hat');\\n\\n const cpAsk = document.querySelector('cp-ask-red-hat');\\n await cpAsk.updateComplete;\\n\\n \\n cpAsk.healthCheckEndpoint = \\\"https://access.redhat.com/api/ask/v1/health\\\";\\n cpAsk.hydraEndpoint = \\\"https://access.redhat.com/hydra/rest/contacts/sso/current\\\";\\n cpAsk.href = \\\"https://access.redhat.com/ask\\\";\\n \\n\\n primer.session.onInit(async () =\u003e {\\n if (primer.session.isAuthenticated()) {\\n // get values from primer session pass them to cpAsk\\n cpAsk.authToken = primer.session.getEncodedToken();\\n cpAsk.userId = primer.session.getUserInfo().sub;\\n }\\n });\",\"type\":\"module\",\"async\":false}]}]\n"])</script><script>self.__next_f.push([1,"33:I[3809,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"450\",\"static/chunks/app/%5Blocale%5D/layout-fc4463590c5a54e3.js\"],\"default\"]\n"])</script><script>self.__next_f.push([1,"2f:[\"$\",\"$L33\",null,{\"formats\":\"$undefined\",\"locale\":\"en\",\"messages\":{\"messages\":{\"CVE Details\":\"CVE Details\",\"known_exploit\":\"Known exploit\",\"known_exploit_vulnerability\":\"This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority.\",\"cve_follow\":\"Follow\",\"cve_following\":\"Following\",\"notification_preferences\":\"Manage Notifications\",\"clear_all\":\"Clear all\",\"cve_redhat_product_no_impact\":\"{cve} does not affect Red Hat software\",\"last_modified\":\"Last modified\",\"public_date\":\"Public on\",\"insights_vulnerability_analysis\":\"Red Hat Lightspeed\",\"exposed_systems\":\"View exposed systems\",\"cve_section_description\":\"Description\",\"mitre_cve\":\"From CVE.org\",\"under_investigation\":\"This CVE is under investigation by Red Hat Product Security.\",\"cve_section_statement\":\"Statement\",\"cve_section_mitigation\":\"Mitigation\",\"cve_section_additional_info\":\"Additional information\",\"faq_quick_link\":\"Frequently asked questions about\",\"cve_section_external_ref\":\"External references\",\"cve_section_affected_packages\":\"Affected Packages and Issued Red Hat Security Errata\",\"severity_classification\":\"What does this mean?\",\"security_bulletin\":\"Security Bulletin\",\"packages_back\":\"Back to Table List\",\"packages_breakdown\":\"Package Score Breakdown\",\"packages_details\":\"Package Details\",\"packages_products_services\":\"Products / services\",\"packages_component\":\"Components\",\"packages_state\":\"State\",\"packages_errata\":\"Errata\",\"package_justification\":\"Justification\",\"packages_release_date\":\"Release date\",\"packages_severity\":\"Severity\",\"packages_individual\":\"Individual Package\",\"packages_overall\":\"Overall CVE\",\"packages_see_details\":\"See score details\",\"packages_vector\":\"Package Vector\",\"empty_table_message\":\"No matching records found\",\"cve_section_affected_packages_disclaimer\":\"Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.\",\"cve_section_cvss_score_details\":\"Common Vulnerability Scoring System (CVSS) Score Details\",\"cvss_2\":\"CVSS v2\",\"cvss_3\":\"CVSS v3\",\"cvss_4\":\"CVSS v4\",\"cvss_review\":\"The following CVSS metrics and score provided are preliminary and subject to review.\",\"cvss_score_breakdown\":\"CVSS {version} Score Breakdown\",\"score_version_explanation\":\"Red Hat CVSS {version} Score Explanation\",\"base_score\":\"Base Score\",\"cvss_vector\":\"Vector\",\"cve_section_understanding_weakness\":\"Understanding the Weakness (CWE)\",\"cve_section_acknowledgements\":\"Acknowledgements\",\"cve_section_faq\":\"Frequently Asked Questions\",\"faq_question_1\":\"Why is Red Hat's CVSS v3 score or Impact different from other vendors?\",\"faq_answer_1\":\"For open source software shipped by multiple vendors, the CVSS base scores may vary for each vendor's version depending on the version they ship, how they ship it, the platform, and even how the software is compiled. This makes scoring of vulnerabilities difficult for third-party vulnerability databases such as NVD that only provide a single CVSS base score for each vulnerability. Red Hat scores reflect how a vulnerability affects our products specifically.\u003cbr\u003e\u003cbr\u003eFor more information, see \u003ca href='https://access.redhat.com/solutions/762393'\u003ehttps://access.redhat.com/solutions/762393\u003c/a\u003e.\",\"faq_question_2\":\"My product is listed as \\\"Under investigation\\\" or \\\"Affected\\\", when will Red Hat release a fix for this vulnerability?\",\"faq_answer_2\":\"\u003cul\u003e\u003cli\u003e\\\"Under investigation\\\" doesn't necessarily mean that the product is affected by this vulnerability. It only means that our Analysis Team is still working on determining whether the product is affected and how it is affected.\u003c/li\u003e\u003cli\u003eThe term 'Affected' means that our Analysis team has determined that this product, such as Red Hat Enterprise Linux 8 or OpenShift Container Platform 4, is affected by this vulnerability and a fix may be released to address this issue in the near future. This includes all minor releases of this product unless noted otherwise in the Statement text.\u003c/li\u003e\u003c/ul\u003e\",\"faq_question_3\":\"What can I do if my product is listed as \\\"Will not fix\\\"?\",\"faq_answer_3\":\"A \\\"will not fix\\\" status means that a fix for an affected product version is not planned or not possible due to complexity, which may create additional risk.\u003cbr\u003e\u003cbr\u003eAvailable options depend mostly on the \u003ca href='https://access.redhat.com/security/updates/classification/'\u003eImpact\u003c/a\u003e of the vulnerability and the current \u003ca href='https://access.redhat.com/product-life-cycles/update_policies'\u003eLife Cycle\u003c/a\u003e phase of your product. Overall, you have the following options:\u003cul\u003e\u003cli\u003eUpgrade to a supported product version that includes a fix for this vulnerability (recommended).\u003c/li\u003e\u003cli\u003eApply a mitigation (if one exists).\u003c/li\u003e\u003cli\u003eCustomers with the Technical Account Manager (TAM) \u003ca href='https://www.redhat.com/en/resources/rhel-security-select-add-on-datasheet'\u003eRHEL Security Select Add-on\u003c/a\u003e can review this CVE directly with their TAM.\u003c/li\u003e\u003c/ul\u003e\",\"faq_question_4\":\"What can I do if my product is listed as \\\"Fix deferred\\\"?\",\"faq_answer_4\":\"A deferred status means that a fix for an affected product version is not guaranteed due to higher-priority development work.\u003cbr\u003e\u003cbr\u003eAvailable options depend mostly on the \u003ca href='https://access.redhat.com/security/updates/classification/'\u003eImpact\u003c/a\u003e of the vulnerability and the current \u003ca href='https://access.redhat.com/product-life-cycles/update_policies'\u003eLife Cycle\u003c/a\u003e phase of your product. Overall, you have the following options:\u003cul\u003e\u003cli\u003eApply a mitigation (if one exists).\u003c/li\u003e\u003cli\u003eRed Hat Engineering focuses on addressing high-priority issues based on the impact and product lifecycle expectations. Therefore, lower-priority issues will not receive immediate fixes.\u003c/li\u003e\u003cli\u003eCustomers with the technical account manager (TAM) \u003ca href='https://www.redhat.com/en/resources/rhel-security-select-add-on-datasheet'\u003eRHEL Security Select Add-on\u003c/a\u003e can review this CVE directly with their TAM.\u003c/li\u003e\u003c/ul\u003e\",\"faq_question_5\":\"What is a mitigation?\",\"faq_answer_5\":\"A mitigation is an action that can be taken to reduce the impact of a security vulnerability, without deploying any fixes.\",\"faq_question_6\":\"I have a Red Hat product but it is not in the above list, is it affected?\",\"faq_answer_6\":\"The listed products were found to include one or more of the components that this vulnerability affects. These products underwent a thorough evaluation to determine their affectedness by this vulnerability. Note that layered products (such as container-based offerings) that consume affected components from any of the products listed in this table may be affected and are not represented.\",\"faq_question_7\":\"Why is my security scanner reporting my product as vulnerable to this vulnerability even though my product version is fixed or not affected?\",\"faq_answer_7\":\"In order to maintain code stability and compatibility, Red Hat usually does not rebase packages to entirely new versions. Instead, we \u003ca href='https://access.redhat.com/security/updates/backporting'\u003ebackport\u003c/a\u003e fixes and new features to an older version of the package we distribute. This can result in some security scanners that only consider the package version to report the package as vulnerable. To avoid this, we suggest that you use an approved vulnerability scanner from our \u003ca href='https://connect.redhat.com/en/partner-with-us/red-hat-vulnerability-scanner-certification'\u003eRed Hat Vulnerability Scanner Certification\u003c/a\u003e program.\",\"faq_question_8\":\"My product is listed as \\\"Out of Support Scope\\\". What does this mean?\",\"faq_answer_8\":\"When a product is listed as 'Out of Support Scope', it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current \u003ca href='https://access.redhat.com/product-life-cycles/update_policies'\u003esupport lifecycle phase\u003c/a\u003e. The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed. The product should be assumed to be affected. Customers are advised to apply any mitigation options documented on this page, consider removing or disabling the impacted component, or upgrade to a supported version of the product that has an update available.\",\"faq_question_9\":\"Why is this CVE listed in Red Hat's CVE database if it doesn't affect Red Hat software?\",\"faq_answer_9\":\"Red Hat maintains records of all CVEs in our CVE database, including those that do not affect our software. This ensures that when you search for a specific vulnerability, you will find an explicit acknowledgment that we have assessed its impact on Red Hat software rather than encountering a missing page that might suggest we have overlooked the issue.\",\"errata_notification\":\"\u003cspan\u003eWant to get errata notifications?\u003c/span\u003e \u003ca href='https://www.redhat.com/wapps/ugc/protected/notif.html?extIdCarryOver=true\u0026sc_cid=701f2000001Css5AAC'\u003eSign up here\u003c/a\u003e.\",\"glossary_link\":\"\u003cspan\u003eNot sure what something means?\u003c/span\u003e Check out our \u003ca href='https://access.redhat.com/security/glossary'\u003eSecurity Glossary\u003c/a\u003e.\",\"footer_clarification\":\"For clarification or corrections, please contact \u003ca href='https://access.redhat.com/security/team/contact/'\u003eRed Hat Product Security\u003c/a\u003e.\",\"footer_copyright\":\"CVE description copyright\"},\"jump_links_sections\":{\"cve_jump_link_section\":\"Jump to section\",\"Description\":\"Description\",\"Statement\":\"Statement\",\"Mitigation\":\"Mitigation\",\"Affected Packages\":\"Affected Packages\",\"CVSS Score Details\":\"CVSS Score Details\",\"Weakness (CWE)\":\"Weakness (CWE)\",\"Acknowledgements\":\"Acknowledgements\",\"FAQ\":\"FAQ\"},\"score_breakdown_labels\":{\"Access Complexity\":\"Access Complexity\",\"Attack Complexity\":\"Attack Complexity\",\"Availability Impact\":\"Availability Impact\",\"Authentication\":\"Authentication\",\"Attack Vector\":\"Attack Vector\",\"Confidentiality Impact\":\"Confidentiality Impact\",\"Confidentiality\":\"Confidentiality\",\"Integrity Impact\":\"Integrity Impact\",\"Privileges Required\":\"Privileges Required\",\"Scope\":\"Scope\",\"User Interaction\":\"User Interaction\",\"Attack Requirements\":\"Attack Requirements\",\"Vulnerable System Confidentiality\":\"Vulnerable System Confidentiality\",\"Vulnerable System Integrity\":\"Vulnerable System Integrity\",\"Vulnerable System Availability\":\"Vulnerable System Availability\",\"Subsequent System Confidentiality\":\"Subsequent System Confidentiality\",\"Subsequent System Integrity\":\"Subsequent System Integrity\",\"Subsequent System Availability\":\"Subsequent System Availability\",\"Exploit Maturity\":\"Exploit Maturity\"},\"voting_feedback\":{\"send_feedback\":\"Send Feedback\",\"cancel\":\"Cancel\",\"contact_us_prefix\":\"If you would like a response, please\",\"contact_us_link\":\"contact us\",\"thank_you\":\"Thank you so much for your feedback.\",\"future_improvement\":\"Your feedback will help us improve in the future.\",\"close\":\"Close\",\"vote_cancel\":\"Feedback cancelled\",\"info_helpful\":\"Was this information helpful?\",\"info_helpful_extended\":\"Was this information helpful? Your feedback is valuable!\"}},\"now\":\"$undefined\",\"timeZone\":\"UTC\",\"children\":\"$L34\"}]\n"])</script><script>self.__next_f.push([1,"35:I[57532,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"450\",\"static/chunks/app/%5Blocale%5D/layout-fc4463590c5a54e3.js\"],\"SessionProvider\"]\n36:I[70840,[\"567\",\"static/chunks/567-dbe161abca8c1327.js\",\"450\",\"static/chunks/app/%5Blocale%5D/layout-fc4463590c5a54e3.js\"],\"VoteFeedbackProvider\"]\n34:[\"$\",\"$L35\",null,{\"children\":[\"$\",\"$L36\",null,{\"children\":[\"$\",\"div\",null,{\"id\":\"cp-content\",\"className\":\"main-content\",\"children\":[\"$\",\"$L2\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L3\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]}]}]\n"])</script></body></html>