{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "title": "Inefficient Regular Expression Complexity in Validator.js", "tracking": { "current_release_date": "2026-08-14T04:25:44+00:00", "generator": { "date": "2026-08-14T04:25:44+00:00", "engine": { "name": "CSAF Generator", "version": "3.3.0" } }, "id": "CVE-2021-3765", "initial_release_date": "2021-11-02T00:00:00+00:00", "revision_history": [ { "date": "2026-08-14T04:25:44+00:00", "number": "1", "summary": "Last generated version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "category": "vendor", "name": "Red Hat", "branches": [ { "category": "product_name", "name": "Migration Toolkit for Virtualization 2.11.0", "product": { "name": "Migration Toolkit for Virtualization 2.11.0", "product_id": "mtv-2.virtualization", "product_identification_helper": { "cpe": "cpe:/a:redhat:migration_toolkit_virtualization:2" } } }, { "category": "product_name", "name": "OpenShift Container Platform 4.19", "product": { "name": "OpenShift Container Platform 4.19", "product_id": "openshift-4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } }, { "category": "product_name", "name": "Red Hat Openshift Container Storage 4.7", "product": { "name": "Red Hat Openshift Container Storage 4.7", "product_id": "openshift-container-storage-4.7.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_container_storage:4" } } }, { "category": "product_name", "name": "Red Hat Openshift Container Storage 4.8", "product": { "name": "Red Hat Openshift Container Storage 4.8", "product_id": "openshift-container-storage-4.8.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_container_storage:4" } } }, { "category": "product_name", "name": "Red Hat Openshift Data Foundations odf-4.18", "product": { "name": "Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_data_foundation:4" } } }, { "category": "product_name", "name": "Red Hat Openshift Data Foundations odf-4.12", "product": { "name": "Red Hat Openshift Data Foundations odf-4.12", "product_id": "openshift-data-foundation-4.12::el8", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_data_foundation:4.12::el8" } } }, { "category": "product_name", "name": "Red Hat Openshift Data Foundations odf-4.13", "product": { "name": "Red Hat Openshift Data Foundations odf-4.13", "product_id": "openshift-data-foundation-4.13::el9", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_data_foundation:4.13::el9" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product_id": "rhacm-2", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0", "product_id": "rhacm-2.11.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2.11" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0", "product_id": "rhacm-2.12.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2.12" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0", "product_id": "rhacm-2.13.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2.13" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0", "product_id": "rhacm-2.14", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2.14" } } }, { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0", "product_id": "rhacm-2.15", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2.15" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux 8.10.z", "product": { "name": "Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8" } } }, { "category": "product_version", "name": "mcg-core-container-v4.12.10", "product": { "name": "mcg-core-container-v4.12.10", "product_id": "mcg-core-container-v4.12.10-0:2", "product_identification_helper": { "purl": "pkg:rpm/redhat/mcg-core-container-v4.12.10@2?epoch=0" } } }, { "category": "product_version", "name": "mcg-core-container-v4.13.0", "product": { "name": "mcg-core-container-v4.13.0", "product_id": "mcg-core-container-v4.13.0-0:41", "product_identification_helper": { "purl": "pkg:rpm/redhat/mcg-core-container-v4.13.0@41?epoch=0" } } }, { "category": "product_version", "name": "migration-toolkit-virtualization/mtv-ui-rhel8", "product": { "name": "migration-toolkit-virtualization/mtv-ui-rhel8", "product_id": "migration-toolkit-virtualization/mtv-ui-rhel8", "product_identification_helper": { "purl": "pkg:oci/mtv-ui-rhel8?repository_url=registry.redhat.io/migration-toolkit-virtualization/mtv-ui-rhel8" } } }, { "category": "product_version", "name": "noobaa-core-container", "product": { "name": "noobaa-core-container", "product_id": "noobaa-core-container", "product_identification_helper": { "purl": "pkg:oci/noobaa-core-container?repository_url=registry.redhat.io/noobaa-core-container" } } }, { "category": "product_version", "name": "ocs4/mcg-core-rhel8", "product": { "name": "ocs4/mcg-core-rhel8", "product_id": "ocs4/mcg-core-rhel8", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel8?repository_url=registry.redhat.io/ocs4/mcg-core-rhel8" } } }, { "category": "product_version", "name": "odf4/mcg-core-rhel9", "product": { "name": "odf4/mcg-core-rhel9", "product_id": "odf4/mcg-core-rhel9", "product_identification_helper": { "purl": "pkg:oci/mcg-core-rhel9?repository_url=registry.redhat.io/odf4/mcg-core-rhel9" } } }, { "category": "product_version", "name": "odf4/odf-console-rhel9", "product": { "name": "odf4/odf-console-rhel9", "product_id": "odf4/odf-console-rhel9", "product_identification_helper": { "purl": "pkg:oci/odf-console-rhel9?repository_url=registry.redhat.io/odf4/odf-console-rhel9" } } }, { "category": "product_version", "name": "odf4/odf-multicluster-console-rhel8", "product": { "name": "odf4/odf-multicluster-console-rhel8", "product_id": "odf4/odf-multicluster-console-rhel8", "product_identification_helper": { "purl": "pkg:oci/odf-multicluster-console-rhel8?repository_url=registry.redhat.io/odf4/odf-multicluster-console-rhel8" } } }, { "category": "product_version", "name": "openshift4/ose-console", "product": { "name": "openshift4/ose-console", "product_id": "openshift4/ose-console", "product_identification_helper": { "purl": "pkg:oci/ose-console?repository_url=registry.redhat.io/openshift4/ose-console" } } }, { "category": "product_version", "name": "pcs", "product": { "name": "pcs", "product_id": "pcs", "product_identification_helper": { "purl": "pkg:rpm/redhat/pcs" } } }, { "category": "product_version", "name": "pcs-snmp", "product": { "name": "pcs-snmp", "product_id": "pcs-snmp", "product_identification_helper": { "purl": "pkg:rpm/redhat/pcs-snmp" } } }, { "category": "product_version", "name": "pcs", "product": { "name": "pcs", "product_id": "pcs.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/pcs?arch=src" } } }, { "category": "product_version", "name": "rhacm2/console-rhel8", "product": { "name": "rhacm2/console-rhel8", "product_id": "rhacm2/console-rhel8", "product_identification_helper": { "purl": "pkg:oci/console-rhel8?repository_url=registry.redhat.io/rhacm2/console-rhel8" } } }, { "category": "product_version", "name": "rhacm2/grc-ui-rhel8", "product": { "name": "rhacm2/grc-ui-rhel8", "product_id": "rhacm2/grc-ui-rhel8", "product_identification_helper": { "purl": "pkg:oci/grc-ui-rhel8?repository_url=registry.redhat.io/rhacm2/grc-ui-rhel8" } } } ] } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "mcg-core-container-v4.12.10-0:2 as a component of Red Hat Openshift Data Foundations odf-4.12", "product_id": "openshift-data-foundation-4.12::el8:mcg-core-container-v4.12.10-0:2" }, "product_reference": "mcg-core-container-v4.12.10-0:2", "relates_to_product_reference": "openshift-data-foundation-4.12::el8" }, { "category": "default_component_of", "full_product_name": { "name": "mcg-core-container-v4.13.0-0:41 as a component of Red Hat Openshift Data Foundations odf-4.13", "product_id": "openshift-data-foundation-4.13::el9:mcg-core-container-v4.13.0-0:41" }, "product_reference": "mcg-core-container-v4.13.0-0:41", "relates_to_product_reference": "openshift-data-foundation-4.13::el9" }, { "category": "default_component_of", "full_product_name": { "name": "migration-toolkit-virtualization/mtv-ui-rhel8 as a component of Migration Toolkit for Virtualization 2.11.0", "product_id": "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8" }, "product_reference": "migration-toolkit-virtualization/mtv-ui-rhel8", "relates_to_product_reference": "mtv-2.virtualization" }, { "category": "default_component_of", "full_product_name": { "name": "noobaa-core-container as a component of Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4:noobaa-core-container" }, "product_reference": "noobaa-core-container", "relates_to_product_reference": "openshift-data-foundation-4" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-core-rhel8 as a component of Red Hat Openshift Container Storage 4.8", "product_id": "openshift-container-storage-4.8.z:ocs4/mcg-core-rhel8" }, "product_reference": "ocs4/mcg-core-rhel8", "relates_to_product_reference": "openshift-container-storage-4.8.z" }, { "category": "default_component_of", "full_product_name": { "name": "ocs4/mcg-core-rhel8 as a component of Red Hat Openshift Container Storage 4.7", "product_id": "openshift-container-storage-4.7.z:ocs4/mcg-core-rhel8" }, "product_reference": "ocs4/mcg-core-rhel8", "relates_to_product_reference": "openshift-container-storage-4.7.z" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/mcg-core-rhel9 as a component of Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4:odf4/mcg-core-rhel9" }, "product_reference": "odf4/mcg-core-rhel9", "relates_to_product_reference": "openshift-data-foundation-4" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-console-rhel9 as a component of Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4:odf4/odf-console-rhel9" }, "product_reference": "odf4/odf-console-rhel9", "relates_to_product_reference": "openshift-data-foundation-4" }, { "category": "default_component_of", "full_product_name": { "name": "odf4/odf-multicluster-console-rhel8 as a component of Red Hat Openshift Data Foundations odf-4.18", "product_id": "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel8" }, "product_reference": "odf4/odf-multicluster-console-rhel8", "relates_to_product_reference": "openshift-data-foundation-4" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-console as a component of OpenShift Container Platform 4.19", "product_id": "openshift-4:openshift4/ose-console" }, "product_reference": "openshift4/ose-console", "relates_to_product_reference": "openshift-4" }, { "category": "default_component_of", "full_product_name": { "name": "pcs as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:pcs" }, "product_reference": "pcs", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "pcs-snmp as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:pcs-snmp" }, "product_reference": "pcs-snmp", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "pcs.src as a component of Red Hat Enterprise Linux 8.10.z", "product_id": "rhel-8:pcs.src" }, "product_reference": "pcs.src", "relates_to_product_reference": "rhel-8" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0", "product_id": "rhacm-2.14:rhacm2/console-rhel8" }, "product_reference": "rhacm2/console-rhel8", "relates_to_product_reference": "rhacm-2.14" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0", "product_id": "rhacm-2.12.z:rhacm2/console-rhel8" }, "product_reference": "rhacm2/console-rhel8", "relates_to_product_reference": "rhacm-2.12.z" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0", "product_id": "rhacm-2.13.z:rhacm2/console-rhel8" }, "product_reference": "rhacm2/console-rhel8", "relates_to_product_reference": "rhacm-2.13.z" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0", "product_id": "rhacm-2.11.z:rhacm2/console-rhel8" }, "product_reference": "rhacm2/console-rhel8", "relates_to_product_reference": "rhacm-2.11.z" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0", "product_id": "rhacm-2.15:rhacm2/console-rhel8" }, "product_reference": "rhacm2/console-rhel8", "relates_to_product_reference": "rhacm-2.15" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/grc-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0", "product_id": "rhacm-2:rhacm2/grc-ui-rhel8" }, "product_reference": "rhacm2/grc-ui-rhel8", "relates_to_product_reference": "rhacm-2" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-3765", "cwe": { "id": "CWE-1333", "name": "Inefficient Regular Expression Complexity" }, "discovery_date": "2022-09-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "rhacm-2.11.z:rhacm2/console-rhel8", "rhacm-2.12.z:rhacm2/console-rhel8", "rhacm-2.13.z:rhacm2/console-rhel8", "rhacm-2.14:rhacm2/console-rhel8", "rhacm-2.15:rhacm2/console-rhel8", "rhel-8:pcs", "rhel-8:pcs-snmp" ] } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the validator package. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "openshift-data-foundation-4.12::el8:mcg-core-container-v4.12.10-0:2", "openshift-data-foundation-4.13::el9:mcg-core-container-v4.13.0-0:41" ], "known_affected": [ "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "openshift-4:openshift4/ose-console", "openshift-container-storage-4.7.z:ocs4/mcg-core-rhel8", "openshift-container-storage-4.8.z:ocs4/mcg-core-rhel8", "openshift-data-foundation-4:noobaa-core-container", "openshift-data-foundation-4:odf4/mcg-core-rhel9", "openshift-data-foundation-4:odf4/odf-console-rhel9", "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel8", "rhacm-2:rhacm2/grc-ui-rhel8", "rhel-8:pcs.src" ], "known_not_affected": [ "rhacm-2.11.z:rhacm2/console-rhel8", "rhacm-2.12.z:rhacm2/console-rhel8", "rhacm-2.13.z:rhacm2/console-rhel8", "rhacm-2.14:rhacm2/console-rhel8", "rhacm-2.15:rhacm2/console-rhel8", "rhel-8:pcs", "rhel-8:pcs-snmp" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-3765" }, { "category": "external", "summary": "nvd.nist.gov", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3765" }, { "category": "external", "summary": "www.cve.org", "url": "https://www.cve.org/CVERecord?id=CVE-2021-3765" } ], "remediations": [ { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "openshift-4:openshift4/ose-console", "openshift-data-foundation-4:odf4/odf-console-rhel9", "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel8", "rhacm-2:rhacm2/grc-ui-rhel8", "rhel-8:pcs.src" ] }, { "category": "no_fix_planned", "details": "Out of support scope", "product_ids": [ "openshift-container-storage-4.7.z:ocs4/mcg-core-rhel8" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "openshift-container-storage-4.8.z:ocs4/mcg-core-rhel8", "openshift-data-foundation-4:noobaa-core-container", "openshift-data-foundation-4:odf4/mcg-core-rhel9" ] }, { "category": "vendor_fix", "date": "2023-06-21T15:22:11+00:00", "details": "Apply advisory RHSA-2023:3742 as per vendors instructions.", "product_ids": [ "openshift-data-foundation-4.13::el9:mcg-core-container-v4.13.0-0:41" ], "url": "https://access.redhat.com/errata/RHSA-2023:3742" }, { "category": "vendor_fix", "date": "2023-12-14T06:09:09+00:00", "details": "Apply advisory RHSA-2023:7820 as per vendors instructions.", "product_ids": [ "openshift-data-foundation-4.12::el8:mcg-core-container-v4.12.10-0:2" ], "url": "https://access.redhat.com/errata/RHSA-2023:7820" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "openshift-4:openshift4/ose-console", "openshift-container-storage-4.7.z:ocs4/mcg-core-rhel8", "openshift-container-storage-4.8.z:ocs4/mcg-core-rhel8", "openshift-data-foundation-4.12::el8:mcg-core-container-v4.12.10-0:2", "openshift-data-foundation-4.13::el9:mcg-core-container-v4.13.0-0:41", "openshift-data-foundation-4:noobaa-core-container", "openshift-data-foundation-4:odf4/mcg-core-rhel9", "openshift-data-foundation-4:odf4/odf-console-rhel9", "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel8", "rhacm-2.11.z:rhacm2/console-rhel8", "rhacm-2.12.z:rhacm2/console-rhel8", "rhacm-2.13.z:rhacm2/console-rhel8", "rhacm-2.14:rhacm2/console-rhel8", "rhacm-2.15:rhacm2/console-rhel8", "rhacm-2:rhacm2/grc-ui-rhel8", "rhel-8:pcs", "rhel-8:pcs-snmp", "rhel-8:pcs.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "mtv-2.virtualization:migration-toolkit-virtualization/mtv-ui-rhel8", "openshift-4:openshift4/ose-console", "openshift-container-storage-4.7.z:ocs4/mcg-core-rhel8", "openshift-container-storage-4.8.z:ocs4/mcg-core-rhel8", "openshift-data-foundation-4.12::el8:mcg-core-container-v4.12.10-0:2", "openshift-data-foundation-4.13::el9:mcg-core-container-v4.13.0-0:41", "openshift-data-foundation-4:noobaa-core-container", "openshift-data-foundation-4:odf4/mcg-core-rhel9", "openshift-data-foundation-4:odf4/odf-console-rhel9", "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel8", "rhacm-2.11.z:rhacm2/console-rhel8", "rhacm-2.12.z:rhacm2/console-rhel8", "rhacm-2.13.z:rhacm2/console-rhel8", "rhacm-2.14:rhacm2/console-rhel8", "rhacm-2.15:rhacm2/console-rhel8", "rhacm-2:rhacm2/grc-ui-rhel8", "rhel-8:pcs", "rhel-8:pcs-snmp", "rhel-8:pcs.src" ] } ], "title": "Inefficient Regular Expression Complexity in Validator.js" } ] }