{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "Information disclosure via valueOf() function", "tracking": { "current_release_date": "2026-08-11T14:54:56+00:00", "generator": { "date": "2026-08-11T14:54:56+00:00", "engine": { "name": "CSAF Generator", "version": "3.3.0" } }, "id": "CVE-2021-23566", "initial_release_date": "2022-01-21T00:00:00+00:00", "revision_history": [ { "date": "2026-08-11T14:54:56+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "Red Hat Ansible Automation Platform 2.6", "product": { "name": "Red Hat Ansible Automation Platform 2.6", "product_id": "ansible_automation_platform-2", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_automation_platform:2" } } }, { "category": "product_name", "name": "Migration Toolkit for Virtualization 2.11.0", "product": { "name": "Migration Toolkit for Virtualization 2.11.0", "product_id": "mtv-2.virtualization", "product_identification_helper": { "cpe": "cpe:/a:redhat:migration_toolkit_virtualization:2" } } }, { "category": "product_name", "name": "OpenShift Developer Tools & Services 4.21", "product": { "name": "OpenShift Developer Tools & Services 4.21", "product_id": "ocp-tools-4", "product_identification_helper": { "cpe": "cpe:/a:redhat:ocp_tools" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.19", "product": { "name": "OpenShift Container Platform 4.19", "product_id": "openshift-4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.11", "product": { "name": "OpenShift Container Platform 4.11", "product_id": "openshift-4.11::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.11::el8" } } }, { "category": "product_name", "name": "Red Hat Openshift Data Foundations odf-4.18", "product": { "name": "Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_data_foundation:4" } } }, { "category": "product_name", "name": "Red Hat Openshift Data Foundations 4.11", "product": { "name": "Red Hat Openshift Data Foundations 4.11", "product_id": "openshift-data-foundation-4.11::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_data_foundation:4.11::el8" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product_id": "rhacm-2", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.3", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.3", "product_id": "rhacm-2.3::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2.3::el8" } } }, { "category": "product_version", "name": "automation-controller", "product": { "name": "automation-controller", "product_id": "automation-controller.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/automation-controller?arch=src" } } }, { "category": "product_version", "name": "console-container-v2.3.8", "product": { "name": "console-container-v2.3.8", "product_id": "console-container-v2.3.8-0:4", "product_identification_helper": { "purl": "pkg:rpm/redhat/console-container-v2.3.8@4?epoch=0" } } }, { "category": "product_version", "name": "grc-ui-container-v2.3.8", "product": { "name": "grc-ui-container-v2.3.8", "product_id": "grc-ui-container-v2.3.8-0:5", "product_identification_helper": { "purl": "pkg:rpm/redhat/grc-ui-container-v2.3.8@5?epoch=0" } } }, { "category": "product_version", "name": "kui-web-terminal-container-v2.3.6", "product": { "name": "kui-web-terminal-container-v2.3.6", "product_id": "kui-web-terminal-container-v2.3.6-0:7", "product_identification_helper": { "purl": "pkg:rpm/redhat/kui-web-terminal-container-v2.3.6@7?epoch=0" } } }, { "category": "product_version", "name": "mcg-core-container-v4.11.0", "product": { "name": "mcg-core-container-v4.11.0", "product_id": "mcg-core-container-v4.11.0-0:30", "product_identification_helper": { "purl": "pkg:rpm/redhat/mcg-core-container-v4.11.0@30?epoch=0" } } }, { "category": "product_version", "name": "migration-toolkit-virtualization/mtv-ui-rhel8", "product": { "name": "migration-toolkit-virtualization/mtv-ui-rhel8", "product_id": "migration-toolkit-virtualization/mtv-ui-rhel8", "product_identification_helper": { "purl": "pkg:oci/mtv-ui-rhel8?repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-ui-rhel8" } } }, { "category": "product_version", "name": "odf4/mcg-core-rhel8", "product": { "name": "odf4/mcg-core-rhel8", "product_id": "odf4/mcg-core-rhel8", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel8?repository_url=registry.redhat.io/odf4/mcg-core-rhel8" } } }, { "category": "product_version", "name": "odo", "product": { "name": "odo", "product_id": "odo.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/odo?arch=src" } } }, { "category": "product_version", "name": "openshift4/ose-console", "product": { "name": "openshift4/ose-console", "product_id": "openshift4/ose-console", "product_identification_helper": { "purl": "pkg:oci/ose-console?repository_url=registry.redhat.io/openshift4/ose-console" } } }, { "category": "product_version", "name": "openshift4/ose-prometheus", "product": { "name": "openshift4/ose-prometheus", "product_id": "openshift4/ose-prometheus", "product_identification_helper": { "purl": "pkg:oci/ose-prometheus?repository_url=registry.redhat.io/openshift4/ose-prometheus" } } }, { "category": "product_version", "name": "openshift4/ose-thanos-rhel8", "product": { "name": "openshift4/ose-thanos-rhel8", "product_id": "openshift4/ose-thanos-rhel8", "product_identification_helper": { "purl": "pkg:oci/ose-thanos-rhel8?repository_url=registry.redhat.io/openshift4/ose-thanos-rhel8" } } }, { "category": "product_version", "name": "ose-thanos-container-v4.11.0", "product": { "name": "ose-thanos-container-v4.11.0", "product_id": "ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream", "product_identification_helper": { "purl": "pkg:rpm/redhat/ose-thanos-container-v4.11.0@202208020235.p0.gf08da2d.assembly.stream?epoch=0" } } }, { "category": "product_version", "name": "rhacm2/kui-web-terminal-rhel8", "product": { "name": "rhacm2/kui-web-terminal-rhel8", "product_id": "rhacm2/kui-web-terminal-rhel8", "product_identification_helper": { "purl": "pkg:oci/kui-web-terminal-rhel8?repository_url=registry.redhat.io/rhacm2/kui-web-terminal-rhel8" } } }, { "category": "product_version", "name": "rhtas/rekor-search-ui-rhel9", "product": { "name": "rhtas/rekor-search-ui-rhel9", "product_id": "rhtas/rekor-search-ui-rhel9", "product_identification_helper": { "purl": "pkg:oci/rekor-search-ui-rhel9?repository_url=registry.redhat.io/rhtas/rekor-search-ui-rhel9" } } }, { "category": "product_version", "name": "search-ui-container-v2.3.8", "product": { "name": "search-ui-container-v2.3.8", "product_id": "search-ui-container-v2.3.8-0:4", "product_identification_helper": { "purl": "pkg:rpm/redhat/search-ui-container-v2.3.8@4?epoch=0" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "automation-controller.src as a component of Red Hat Ansible Automation Platform 2.6", "product_id": "ansible_automation_platform-2:automation-controller.src" }, "product_reference": "automation-controller.src", "relates_to_product_reference": "ansible_automation_platform-2" }, { "category": "default_component_of", "full_product_name": { "name": "console-container-v2.3.8-0:4 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3", "product_id": "rhacm-2.3::el8:console-container-v2.3.8-0:4" }, "product_reference": "console-container-v2.3.8-0:4", "relates_to_product_reference": "rhacm-2.3::el8" }, { "category": "default_component_of", "full_product_name": { "name": "grc-ui-container-v2.3.8-0:5 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3", "product_id": "rhacm-2.3::el8:grc-ui-container-v2.3.8-0:5" }, "product_reference": "grc-ui-container-v2.3.8-0:5", "relates_to_product_reference": "rhacm-2.3::el8" }, { "category": "default_component_of", "full_product_name": { "name": "kui-web-terminal-container-v2.3.6-0:7 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3", "product_id": "rhacm-2.3::el8:kui-web-terminal-container-v2.3.6-0:7" }, "product_reference": "kui-web-terminal-container-v2.3.6-0:7", "relates_to_product_reference": "rhacm-2.3::el8" }, { "category": "default_component_of", "full_product_name": { "name": "mcg-core-container-v4.11.0-0:30 as a component of Red Hat Openshift Data Foundations 4.11", "product_id": "openshift-data-foundation-4.11::el8:mcg-core-container-v4.11.0-0:30" }, "product_reference": "mcg-core-container-v4.11.0-0:30", "relates_to_product_reference": "openshift-data-foundation-4.11::el8" }, { "category": "default_component_of", "full_product_name": { "name": "migration-toolkit-virtualization/mtv-ui-rhel8 as a component of Migration Toolkit for Virtualization 2.11.0", "product_id": "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8" }, "product_reference": "migration-toolkit-virtualization/mtv-ui-rhel8", "relates_to_product_reference": "mtv-2.virtualization" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-core-rhel8 as a component of Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4:odf4/mcg-core-rhel8" }, "product_reference": "odf4/mcg-core-rhel8", "relates_to_product_reference": "openshift-data-foundation-4" }, { "category": "default_component_of", "full_product_name": { "name": "odo.src as a component of OpenShift Developer Tools & Services 4.21", "product_id": "ocp-tools-4:odo.src" }, "product_reference": "odo.src", "relates_to_product_reference": "ocp-tools-4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-console as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4:openshift4/ose-console" }, "product_reference": "openshift4/ose-console", "relates_to_product_reference": "openshift-4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-console as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product_id": "rhacm-2:openshift4/ose-console" }, "product_reference": "openshift4/ose-console", "relates_to_product_reference": "rhacm-2" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-prometheus as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4:openshift4/ose-prometheus" }, "product_reference": "openshift4/ose-prometheus", "relates_to_product_reference": "openshift-4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-thanos-rhel8 as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4:openshift4/ose-thanos-rhel8" }, "product_reference": "openshift4/ose-thanos-rhel8", "relates_to_product_reference": "openshift-4" }, { "category": "default_component_of", "full_product_name": { "name": "ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream as a component of OpenShift Container Platform 4.11", "product_id": "openshift-4.11::el8:ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream" }, "product_reference": "ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream", "relates_to_product_reference": "openshift-4.11::el8" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/kui-web-terminal-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product_id": "rhacm-2:rhacm2/kui-web-terminal-rhel8" }, "product_reference": "rhacm2/kui-web-terminal-rhel8", "relates_to_product_reference": "rhacm-2" }, { "category": "default_component_of", "full_product_name": { "name": "rhtas/rekor-search-ui-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product_id": "rhacm-2:rhtas/rekor-search-ui-rhel9" }, "product_reference": "rhtas/rekor-search-ui-rhel9", "relates_to_product_reference": "rhacm-2" }, { "category": "default_component_of", "full_product_name": { "name": "search-ui-container-v2.3.8-0:4 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3", "product_id": "rhacm-2.3::el8:search-ui-container-v2.3.8-0:4" }, "product_reference": "search-ui-container-v2.3.8-0:4", "relates_to_product_reference": "rhacm-2.3::el8" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-23566", "cwe": { "id": "CWE-212", "name": "Improper Removal of Sensitive Information Before Storage or Transfer" }, "discovery_date": "2022-02-04T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "ocp-tools-4:odo.src", "openshift-4:openshift4/ose-console" ] } ], "notes": [ { "category": "description", "text": "A flaw was found in the nanoid library where the valueOf() function allows the reproduction of the last id generated. This flaw allows an attacker to expose sensitive information.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "openshift-4.11::el8:ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream", "openshift-data-foundation-4.11::el8:mcg-core-container-v4.11.0-0:30", "rhacm-2.3::el8:console-container-v2.3.8-0:4", "rhacm-2.3::el8:grc-ui-container-v2.3.8-0:5", "rhacm-2.3::el8:kui-web-terminal-container-v2.3.6-0:7", "rhacm-2.3::el8:search-ui-container-v2.3.8-0:4" ], "known_affected": [ "ansible_automation_platform-2:automation-controller.src", "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "openshift-4:openshift4/ose-prometheus", "openshift-4:openshift4/ose-thanos-rhel8", "openshift-data-foundation-4:odf4/mcg-core-rhel8", "rhacm-2:openshift4/ose-console", "rhacm-2:rhacm2/kui-web-terminal-rhel8", "rhacm-2:rhtas/rekor-search-ui-rhel9" ], "known_not_affected": [ "ocp-tools-4:odo.src", "openshift-4:openshift4/ose-console" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-23566" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23566" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2021-23566" } ], "remediations": [ { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "ansible_automation_platform-2:automation-controller.src", "openshift-4:openshift4/ose-prometheus" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "openshift-4:openshift4/ose-thanos-rhel8", "openshift-data-foundation-4:odf4/mcg-core-rhel8", "rhacm-2:openshift4/ose-console", "rhacm-2:rhacm2/kui-web-terminal-rhel8", "rhacm-2:rhtas/rekor-search-ui-rhel9" ] }, { "category": "vendor_fix", "date": "2022-03-04T01:35:35+00:00", "details": "Apply advisory RHSA-2022:0595 as per vendors instructions.", "product_ids": [ "rhacm-2.3::el8:kui-web-terminal-container-v2.3.6-0:7" ], "url": "https://access.redhat.com/errata/RHSA-2022:0595" }, { "category": "vendor_fix", "date": "2022-03-28T19:34:25+00:00", "details": "Apply advisory RHSA-2022:1083 as per vendors instructions.", "product_ids": [ "rhacm-2.3::el8:console-container-v2.3.8-0:4", "rhacm-2.3::el8:grc-ui-container-v2.3.8-0:5", "rhacm-2.3::el8:search-ui-container-v2.3.8-0:4" ], "url": "https://access.redhat.com/errata/RHSA-2022:1083" }, { "category": "vendor_fix", "date": "2022-08-24T13:45:52+00:00", "details": "Apply advisory RHSA-2022:6156 as per vendors instructions.", "product_ids": [ "openshift-data-foundation-4.11::el8:mcg-core-container-v4.11.0-0:30" ], "url": "https://access.redhat.com/errata/RHSA-2022:6156" }, { "category": "vendor_fix", "date": "2022-08-10T10:32:53+00:00", "details": "Apply advisory RHSA-2022:5069 as per vendors instructions.", "product_ids": [ "openshift-4.11::el8:ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream" ], "url": "https://access.redhat.com/errata/RHSA-2022:5069" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM" }, "products": [ "ansible_automation_platform-2:automation-controller.src", "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "ocp-tools-4:odo.src", "openshift-4.11::el8:ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream", "openshift-4:openshift4/ose-console", "openshift-4:openshift4/ose-prometheus", "openshift-4:openshift4/ose-thanos-rhel8", "openshift-data-foundation-4.11::el8:mcg-core-container-v4.11.0-0:30", "openshift-data-foundation-4:odf4/mcg-core-rhel8", "rhacm-2.3::el8:console-container-v2.3.8-0:4", "rhacm-2.3::el8:grc-ui-container-v2.3.8-0:5", "rhacm-2.3::el8:kui-web-terminal-container-v2.3.6-0:7", "rhacm-2.3::el8:search-ui-container-v2.3.8-0:4", "rhacm-2:openshift4/ose-console", "rhacm-2:rhacm2/kui-web-terminal-rhel8", "rhacm-2:rhtas/rekor-search-ui-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "ansible_automation_platform-2:automation-controller.src", "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "ocp-tools-4:odo.src", "openshift-4.11::el8:ose-thanos-container-v4.11.0-0:202208020235.p0.gf08da2d.assembly.stream", "openshift-4:openshift4/ose-console", "openshift-4:openshift4/ose-prometheus", "openshift-4:openshift4/ose-thanos-rhel8", "openshift-data-foundation-4.11::el8:mcg-core-container-v4.11.0-0:30", "openshift-data-foundation-4:odf4/mcg-core-rhel8", "rhacm-2.3::el8:console-container-v2.3.8-0:4", "rhacm-2.3::el8:grc-ui-container-v2.3.8-0:5", "rhacm-2.3::el8:kui-web-terminal-container-v2.3.6-0:7", "rhacm-2.3::el8:search-ui-container-v2.3.8-0:4", "rhacm-2:openshift4/ose-console", "rhacm-2:rhacm2/kui-web-terminal-rhel8", "rhacm-2:rhtas/rekor-search-ui-rhel9" ] } ], "title": "Information disclosure via valueOf() function" } ] }