938 lines
43 KiB
JSON
938 lines
43 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-35172",
|
|
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "GitHub_M",
|
|
"dateReserved": "2026-04-01T17:26:21.133Z",
|
|
"datePublished": "2026-04-06T19:08:44.512Z",
|
|
"dateUpdated": "2026-09-09T12:04:57.565Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"title": "Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-284",
|
|
"lang": "en",
|
|
"description": "CWE-284: Improper Access Control",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "NONE",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"version": "3.1"
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"name": "https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc",
|
|
"tags": [
|
|
"x_refsource_CONFIRM"
|
|
],
|
|
"url": "https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "distribution",
|
|
"product": "distribution",
|
|
"versions": [
|
|
{
|
|
"version": "< 3.1.0",
|
|
"status": "affected"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"shortName": "GitHub_M",
|
|
"dateUpdated": "2026-04-06T19:08:44.512Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0."
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "GHSA-f2g3-hh2r-cwgc",
|
|
"discovery": "UNKNOWN"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-04-07T14:45:08.558570Z",
|
|
"id": "CVE-2026-35172",
|
|
"options": [
|
|
{
|
|
"Exploitation": "poc"
|
|
},
|
|
{
|
|
"Automatable": "yes"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-04-07T14:46:34.904Z"
|
|
}
|
|
},
|
|
{
|
|
"affected": [
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4.12::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-lifecycle-manager",
|
|
"product": "Red Hat OpenShift Container Platform 4.12",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1781122773",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4.13::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-lifecycle-manager",
|
|
"product": "Red Hat OpenShift Container Platform 4.13",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1781123052",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4.14::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-lifecycle-manager",
|
|
"product": "Red Hat OpenShift Container Platform 4.14",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1781833795",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4.15::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-lifecycle-manager-rhel9",
|
|
"product": "Red Hat OpenShift Container Platform 4.15",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1779915499",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4.16::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-lifecycle-manager-rhel9",
|
|
"product": "Red Hat OpenShift Container Platform 4.16",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1780957268",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/cephcsi-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782932114",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/cephcsi-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782931768",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/devicefinder-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782932104",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/mcg-core-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783536000",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/mcg-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783535989",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/ocs-client-console-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783536515",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/ocs-client-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782932521",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/ocs-metrics-exporter-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783018461",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/ocs-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783018421",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-blackbox-exporter-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782932812",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-cli-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783537001",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782932919",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-console-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783537586",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-cosi-sidecar-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782932969",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-csi-addons-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782933015",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-csi-addons-sidecar-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782933042",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-drbd-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783537392",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-external-snapshotter-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782933235",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782933251",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-multicluster-console-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783537955",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-multicluster-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782933417",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-must-gather-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783537742",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odf-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782933602",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odr-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1783019377",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odr-volsync-plugin-mover-rhel9",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782934054",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/odr-volsync-plugin-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782934036",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://catalog.redhat.com/software/containers/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift_data_foundation:4.22::el9"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "odf4/rook-ceph-rhel9-operator",
|
|
"product": "Red Hat Openshift Data Foundation 4.22",
|
|
"vendor": "Red Hat",
|
|
"versions": [
|
|
{
|
|
"lessThan": "*",
|
|
"status": "unaffected",
|
|
"version": "1782934284",
|
|
"versionType": "rpm"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:multicluster_engine"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "multicluster-engine/assisted-installer-controller-rhel9",
|
|
"product": "Multicluster Engine for Kubernetes",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:multicluster_engine"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "multicluster-engine/assisted-service-9-rhel9",
|
|
"product": "Multicluster Engine for Kubernetes",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:multicluster_engine"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "multicluster-engine/must-gather-rhel9",
|
|
"product": "Multicluster Engine for Kubernetes",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:acm:2"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "rhacm2/acm-must-gather-rhel9",
|
|
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-framework-tools-rhel9",
|
|
"product": "Red Hat OpenShift Container Platform 4",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4"
|
|
],
|
|
"defaultStatus": "affected",
|
|
"packageName": "openshift4/ose-operator-registry",
|
|
"product": "Red Hat OpenShift Container Platform 4",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4"
|
|
],
|
|
"defaultStatus": "unknown",
|
|
"packageName": "openshift-clients",
|
|
"product": "Red Hat OpenShift Container Platform 4",
|
|
"vendor": "Red Hat"
|
|
},
|
|
{
|
|
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
|
|
"cpes": [
|
|
"cpe:/a:redhat:openshift:4"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "redhat/redhat-operator-index",
|
|
"product": "Red Hat OpenShift Container Platform 4",
|
|
"vendor": "Red Hat"
|
|
}
|
|
],
|
|
"datePublic": "2026-04-06T19:08:44.512Z",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A flaw was found in Distribution, a toolkit used for managing container content. When specific caching and deletion features are enabled, a remote attacker can exploit a vulnerability that allows previously deleted content to become readable again. This occurs because the system does not fully remove all references to the deleted data, leading to unauthorized information disclosure."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"content": {
|
|
"namespace": "https://access.redhat.com/security/updates/classification/",
|
|
"value": "Important"
|
|
},
|
|
"type": "Red Hat severity rating"
|
|
}
|
|
},
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 7.5,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "NONE",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
|
"version": "3.1"
|
|
},
|
|
"format": "CVSS"
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-524",
|
|
"description": "Use of Cache Containing Sensitive Information",
|
|
"lang": "en",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"tags": [
|
|
"vdb-entry",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/security/cve/CVE-2026-35172"
|
|
},
|
|
{
|
|
"name": "RHBZ#2455571",
|
|
"tags": [
|
|
"issue-tracking",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455571"
|
|
},
|
|
{
|
|
"tags": [
|
|
"x_sadp-csaf-vex"
|
|
],
|
|
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35172.json"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:26529"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:26543"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:28893"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:23234"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:25045"
|
|
},
|
|
{
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"x_refsource_REDHAT"
|
|
],
|
|
"url": "https://access.redhat.com/errata/RHSA-2026:37387"
|
|
}
|
|
],
|
|
"solutions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:26529: Red Hat OpenShift Container Platform 4.12"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:26543: Red Hat OpenShift Container Platform 4.13"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:23234: Red Hat OpenShift Container Platform 4.15"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:25045: Red Hat OpenShift Container Platform 4.16"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"value": "RHSA-2026:37387: Red Hat Openshift Data Foundation 4.22"
|
|
}
|
|
],
|
|
"timeline": [
|
|
{
|
|
"lang": "en",
|
|
"time": "2026-04-06T20:01:47.396Z",
|
|
"value": "Reported to Red Hat."
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"time": "2026-04-06T19:08:44.512Z",
|
|
"value": "Made public."
|
|
}
|
|
],
|
|
"title": "github.com/distribution/distribution: Distribution: Information disclosure via stale references after content deletion",
|
|
"x_adpType": "supplier",
|
|
"x_generator": {
|
|
"engine": "sadp-cli 1.0.0"
|
|
},
|
|
"providerMetadata": {
|
|
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
|
|
"shortName": "redhat-SADP",
|
|
"dateUpdated": "2026-09-09T12:04:57.565Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |