{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "type confusion vulnerability can lead to a bypass of a previous prototype pollution fix when the pointer components are arrays",
    "tracking": {
      "current_release_date": "2026-08-11T14:54:57+00:00",
      "generator": {
        "date": "2026-08-11T14:54:57+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2021-23807",
      "initial_release_date": "2021-08-31T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T14:54:57+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.12",
            "product": {
              "name": "OpenShift Container Platform 4.12",
              "product_id": "openshift-4.12.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.12"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.13",
            "product": {
              "name": "OpenShift Container Platform 4.13",
              "product_id": "openshift-4.13.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.13"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.14",
            "product": {
              "name": "OpenShift Container Platform 4.14",
              "product_id": "openshift-4.14.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.14"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.15.z",
            "product": {
              "name": "OpenShift Container Platform 4.15.z",
              "product_id": "openshift-4.15.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.15"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.16.z",
            "product": {
              "name": "OpenShift Container Platform 4.16.z",
              "product_id": "openshift-4.16.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.16"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.17",
            "product": {
              "name": "OpenShift Container Platform 4.17",
              "product_id": "openshift-4.17",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.17"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.18",
            "product": {
              "name": "OpenShift Container Platform 4.18",
              "product_id": "openshift-4.18",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.18"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.19",
            "product": {
              "name": "OpenShift Container Platform 4.19",
              "product_id": "openshift-4.19",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.19"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.20",
            "product": {
              "name": "OpenShift Container Platform 4.20",
              "product_id": "openshift-4.20",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4.20"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 3.11.0",
            "product": {
              "name": "OpenShift Container Platform 3.11.0",
              "product_id": "openshift-enterprise-3.11",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:3"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Quay v3.10.0",
            "product": {
              "name": "Red Hat Quay v3.10.0",
              "product_id": "quay-3.10",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:quay:3.10"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Quay v3.12.0",
            "product": {
              "name": "Red Hat Quay v3.12.0",
              "product_id": "quay-3.12",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:quay:3.12"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Quay v3.13.0",
            "product": {
              "name": "Red Hat Quay v3.13.0",
              "product_id": "quay-3.13",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:quay:3.13"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Quay v3.14.0",
            "product": {
              "name": "Red Hat Quay v3.14.0",
              "product_id": "quay-3.14",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:quay:3.14"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Quay v3.15.0",
            "product": {
              "name": "Red Hat Quay v3.15.0",
              "product_id": "quay-3.15",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:quay:3.15"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Quay v3.9.18",
            "product": {
              "name": "Red Hat Quay v3.9.18",
              "product_id": "quay-3.9",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:quay:3.9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "kibana",
            "product": {
              "name": "kibana",
              "product_id": "kibana",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/kibana"
              }
            }
          },
          {
            "category": "product_version",
            "name": "kibana",
            "product": {
              "name": "kibana",
              "product_id": "kibana.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/kibana?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-metering-hadoop",
            "product": {
              "name": "openshift4/ose-metering-hadoop",
              "product_id": "openshift4/ose-metering-hadoop",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-metering-hadoop?repository_url=registry.redhat.io/openshift4/ose-metering-hadoop"
              }
            }
          },
          {
            "category": "product_version",
            "name": "quay/quay-rhel8",
            "product": {
              "name": "quay/quay-rhel8",
              "product_id": "quay/quay-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/quay-rhel8?repository_url=registry.redhat.io/quay/quay-rhel8"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kibana as a component of OpenShift Container Platform 3.11.0",
          "product_id": "openshift-enterprise-3.11:kibana"
        },
        "product_reference": "kibana",
        "relates_to_product_reference": "openshift-enterprise-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kibana.src as a component of OpenShift Container Platform 3.11.0",
          "product_id": "openshift-enterprise-3.11:kibana.src"
        },
        "product_reference": "kibana.src",
        "relates_to_product_reference": "openshift-enterprise-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.12",
          "product_id": "openshift-4.12.z:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.14",
          "product_id": "openshift-4.14.z:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.14.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.19",
          "product_id": "openshift-4.19:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.19"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.16.z",
          "product_id": "openshift-4.16.z:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.16.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.13",
          "product_id": "openshift-4.13.z:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.20",
          "product_id": "openshift-4.20:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.20"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.17",
          "product_id": "openshift-4.17:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.15.z",
          "product_id": "openshift-4.15.z:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.15.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-metering-hadoop as a component of OpenShift Container Platform 4.18",
          "product_id": "openshift-4.18:openshift4/ose-metering-hadoop"
        },
        "product_reference": "openshift4/ose-metering-hadoop",
        "relates_to_product_reference": "openshift-4.18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8 as a component of Red Hat Quay v3.15.0",
          "product_id": "quay-3.15:quay/quay-rhel8"
        },
        "product_reference": "quay/quay-rhel8",
        "relates_to_product_reference": "quay-3.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8 as a component of Red Hat Quay v3.9.18",
          "product_id": "quay-3.9:quay/quay-rhel8"
        },
        "product_reference": "quay/quay-rhel8",
        "relates_to_product_reference": "quay-3.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8 as a component of Red Hat Quay v3.10.0",
          "product_id": "quay-3.10:quay/quay-rhel8"
        },
        "product_reference": "quay/quay-rhel8",
        "relates_to_product_reference": "quay-3.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8 as a component of Red Hat Quay v3.14.0",
          "product_id": "quay-3.14:quay/quay-rhel8"
        },
        "product_reference": "quay/quay-rhel8",
        "relates_to_product_reference": "quay-3.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8 as a component of Red Hat Quay v3.13.0",
          "product_id": "quay-3.13:quay/quay-rhel8"
        },
        "product_reference": "quay/quay-rhel8",
        "relates_to_product_reference": "quay-3.13"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8 as a component of Red Hat Quay v3.12.0",
          "product_id": "quay-3.12:quay/quay-rhel8"
        },
        "product_reference": "quay/quay-rhel8",
        "relates_to_product_reference": "quay-3.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-23807",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2021-11-03T00:00:00+00:00",
      "notes": [
        {
          "category": "other",
          "text": "In Red Hat Quay,  JSON pointer is a development dependency, therefore the impact of this flaw is rated Low. A fix may be delivered in future Quay updates.\n\nHadoop-container is affected, but it's deprecated since OpenShift Container Platform 4.6, hence marked as WONTFIX.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A Type Confusion vulnerability was found in node-jsonpointer. This issue leads to the bypass of a previous Prototype Pollution fix when the pointer components are arrays. This flaw allows an attacker to use objects of incompatible base types, leading to remote code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_affected": [
          "openshift-4.12.z:openshift4/ose-metering-hadoop",
          "openshift-4.13.z:openshift4/ose-metering-hadoop",
          "openshift-4.14.z:openshift4/ose-metering-hadoop",
          "openshift-4.15.z:openshift4/ose-metering-hadoop",
          "openshift-4.16.z:openshift4/ose-metering-hadoop",
          "openshift-4.17:openshift4/ose-metering-hadoop",
          "openshift-4.18:openshift4/ose-metering-hadoop",
          "openshift-4.19:openshift4/ose-metering-hadoop",
          "openshift-4.20:openshift4/ose-metering-hadoop",
          "openshift-enterprise-3.11:kibana",
          "openshift-enterprise-3.11:kibana.src",
          "quay-3.10:quay/quay-rhel8",
          "quay-3.12:quay/quay-rhel8",
          "quay-3.13:quay/quay-rhel8",
          "quay-3.14:quay/quay-rhel8",
          "quay-3.15:quay/quay-rhel8",
          "quay-3.9:quay/quay-rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-23807"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23807"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-23807"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "openshift-4.12.z:openshift4/ose-metering-hadoop",
            "openshift-4.13.z:openshift4/ose-metering-hadoop",
            "openshift-4.14.z:openshift4/ose-metering-hadoop",
            "openshift-4.15.z:openshift4/ose-metering-hadoop",
            "openshift-4.16.z:openshift4/ose-metering-hadoop",
            "openshift-4.17:openshift4/ose-metering-hadoop",
            "openshift-4.18:openshift4/ose-metering-hadoop",
            "openshift-4.19:openshift4/ose-metering-hadoop",
            "openshift-4.20:openshift4/ose-metering-hadoop",
            "quay-3.10:quay/quay-rhel8",
            "quay-3.12:quay/quay-rhel8",
            "quay-3.13:quay/quay-rhel8",
            "quay-3.14:quay/quay-rhel8",
            "quay-3.15:quay/quay-rhel8",
            "quay-3.9:quay/quay-rhel8"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "openshift-enterprise-3.11:kibana",
            "openshift-enterprise-3.11:kibana.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "baseScore": 7.3,
            "baseSeverity": "HIGH"
          },
          "products": [
            "openshift-4.12.z:openshift4/ose-metering-hadoop",
            "openshift-4.13.z:openshift4/ose-metering-hadoop",
            "openshift-4.14.z:openshift4/ose-metering-hadoop",
            "openshift-4.15.z:openshift4/ose-metering-hadoop",
            "openshift-4.16.z:openshift4/ose-metering-hadoop",
            "openshift-4.17:openshift4/ose-metering-hadoop",
            "openshift-4.18:openshift4/ose-metering-hadoop",
            "openshift-4.19:openshift4/ose-metering-hadoop",
            "openshift-4.20:openshift4/ose-metering-hadoop",
            "openshift-enterprise-3.11:kibana",
            "openshift-enterprise-3.11:kibana.src",
            "quay-3.10:quay/quay-rhel8",
            "quay-3.12:quay/quay-rhel8",
            "quay-3.13:quay/quay-rhel8",
            "quay-3.14:quay/quay-rhel8",
            "quay-3.15:quay/quay-rhel8",
            "quay-3.9:quay/quay-rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low",
          "product_ids": [
            "quay-3.10:quay/quay-rhel8",
            "quay-3.12:quay/quay-rhel8",
            "quay-3.13:quay/quay-rhel8",
            "quay-3.14:quay/quay-rhel8",
            "quay-3.15:quay/quay-rhel8",
            "quay-3.9:quay/quay-rhel8"
          ]
        },
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "openshift-4.12.z:openshift4/ose-metering-hadoop",
            "openshift-4.13.z:openshift4/ose-metering-hadoop",
            "openshift-4.14.z:openshift4/ose-metering-hadoop",
            "openshift-4.15.z:openshift4/ose-metering-hadoop",
            "openshift-4.16.z:openshift4/ose-metering-hadoop",
            "openshift-4.17:openshift4/ose-metering-hadoop",
            "openshift-4.18:openshift4/ose-metering-hadoop",
            "openshift-4.19:openshift4/ose-metering-hadoop",
            "openshift-4.20:openshift4/ose-metering-hadoop",
            "openshift-enterprise-3.11:kibana",
            "openshift-enterprise-3.11:kibana.src"
          ]
        }
      ],
      "title": "type confusion vulnerability can lead to a bypass of a previous prototype pollution fix when the pointer components are arrays"
    }
  ]
}