{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "prototype pollution vulnerability",
    "tracking": {
      "current_release_date": "2026-08-11T15:00:16+00:00",
      "generator": {
        "date": "2026-08-11T15:00:16+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2021-3805",
      "initial_release_date": "2021-09-13T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T15:00:16+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "OpenShift Service Mesh maistra-1.1.3",
            "product": {
              "name": "OpenShift Service Mesh maistra-1.1.3",
              "product_id": "maistra-1.1.3",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:service_mesh:1"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Service Mesh OSSM 2.0.0",
            "product": {
              "name": "OpenShift Service Mesh OSSM 2.0.0",
              "product_id": "ossm-2.0",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:service_mesh:2.0"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
              "product_id": "rhacm-2",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.3",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.3",
              "product_id": "rhacm-2.3::el8",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2.3::el8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "grc-ui-api-container-v2.3.3",
            "product": {
              "name": "grc-ui-api-container-v2.3.3",
              "product_id": "grc-ui-api-container-v2.3.3-0:5",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/grc-ui-api-container-v2.3.3@5?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/application-ui-rhel8",
            "product": {
              "name": "rhacm2/application-ui-rhel8",
              "product_id": "rhacm2/application-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/application-ui-rhel8?repository_url=registry.redhat.io/rhacm2/application-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/console-api-rhel8",
            "product": {
              "name": "rhacm2/console-api-rhel8",
              "product_id": "rhacm2/console-api-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/console-api-rhel8?repository_url=registry.redhat.io/rhacm2/console-api-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/grc-ui-rhel8",
            "product": {
              "name": "rhacm2/grc-ui-rhel8",
              "product_id": "rhacm2/grc-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/grc-ui-rhel8?repository_url=registry.redhat.io/rhacm2/grc-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/mcm-topology-api-rhel8",
            "product": {
              "name": "rhacm2/mcm-topology-api-rhel8",
              "product_id": "rhacm2/mcm-topology-api-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/mcm-topology-api-rhel8?repository_url=registry.redhat.io/rhacm2/mcm-topology-api-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/search-ui-rhel8",
            "product": {
              "name": "rhacm2/search-ui-rhel8",
              "product_id": "rhacm2/search-ui-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/search-ui-rhel8?repository_url=registry.redhat.io/rhacm2/search-ui-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "search-api-container-v2.3.3",
            "product": {
              "name": "search-api-container-v2.3.3",
              "product_id": "search-api-container-v2.3.3-0:5",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/search-api-container-v2.3.3@5?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "search-api",
            "product": {
              "name": "search-api",
              "product_id": "search-api.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/search-api?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "search-ui-container-v2.3.3",
            "product": {
              "name": "search-ui-container-v2.3.3",
              "product_id": "search-ui-container-v2.3.3-0:7",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/search-ui-container-v2.3.3@7?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "search-ui",
            "product": {
              "name": "search-ui",
              "product_id": "search-ui.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/search-ui?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-prometheus",
            "product": {
              "name": "servicemesh-prometheus",
              "product_id": "servicemesh-prometheus",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-prometheus"
              }
            }
          },
          {
            "category": "product_version",
            "name": "servicemesh-prometheus",
            "product": {
              "name": "servicemesh-prometheus",
              "product_id": "servicemesh-prometheus.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/servicemesh-prometheus?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grc-ui-api-container-v2.3.3-0:5 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3",
          "product_id": "rhacm-2.3::el8:grc-ui-api-container-v2.3.3-0:5"
        },
        "product_reference": "grc-ui-api-container-v2.3.3-0:5",
        "relates_to_product_reference": "rhacm-2.3::el8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/application-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/application-ui-rhel8"
        },
        "product_reference": "rhacm2/application-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/console-api-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/console-api-rhel8"
        },
        "product_reference": "rhacm2/console-api-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/grc-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/grc-ui-rhel8"
        },
        "product_reference": "rhacm2/grc-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/mcm-topology-api-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/mcm-topology-api-rhel8"
        },
        "product_reference": "rhacm2/mcm-topology-api-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/search-ui-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:rhacm2/search-ui-rhel8"
        },
        "product_reference": "rhacm2/search-ui-rhel8",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "search-api-container-v2.3.3-0:5 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3",
          "product_id": "rhacm-2.3::el8:search-api-container-v2.3.3-0:5"
        },
        "product_reference": "search-api-container-v2.3.3-0:5",
        "relates_to_product_reference": "rhacm-2.3::el8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "search-api.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:search-api.src"
        },
        "product_reference": "search-api.src",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "search-ui-container-v2.3.3-0:7 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.3",
          "product_id": "rhacm-2.3::el8:search-ui-container-v2.3.3-0:7"
        },
        "product_reference": "search-ui-container-v2.3.3-0:7",
        "relates_to_product_reference": "rhacm-2.3::el8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "search-ui.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.7.0",
          "product_id": "rhacm-2:search-ui.src"
        },
        "product_reference": "search-ui.src",
        "relates_to_product_reference": "rhacm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus as a component of OpenShift Service Mesh maistra-1.1.3",
          "product_id": "maistra-1.1.3:servicemesh-prometheus"
        },
        "product_reference": "servicemesh-prometheus",
        "relates_to_product_reference": "maistra-1.1.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-prometheus"
        },
        "product_reference": "servicemesh-prometheus",
        "relates_to_product_reference": "ossm-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus.src as a component of OpenShift Service Mesh OSSM 2.0.0",
          "product_id": "ossm-2.0:servicemesh-prometheus.src"
        },
        "product_reference": "servicemesh-prometheus.src",
        "relates_to_product_reference": "ossm-2.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "servicemesh-prometheus.src as a component of OpenShift Service Mesh maistra-1.1.3",
          "product_id": "maistra-1.1.3:servicemesh-prometheus.src"
        },
        "product_reference": "servicemesh-prometheus.src",
        "relates_to_product_reference": "maistra-1.1.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-3805",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2021-09-17T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhacm-2:rhacm2/application-ui-rhel8"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the object-path nodejs library when the del() function is called to validate object properties. An attacker can manipulate or alter the prototype of an object causing the modification of default properties on all objects. This could lead into a service disruption or a denial of service attack (DoS).",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "rhacm-2.3::el8:grc-ui-api-container-v2.3.3-0:5",
          "rhacm-2.3::el8:search-api-container-v2.3.3-0:5",
          "rhacm-2.3::el8:search-ui-container-v2.3.3-0:7"
        ],
        "known_affected": [
          "maistra-1.1.3:servicemesh-prometheus",
          "maistra-1.1.3:servicemesh-prometheus.src",
          "ossm-2.0:servicemesh-prometheus",
          "ossm-2.0:servicemesh-prometheus.src",
          "rhacm-2:rhacm2/console-api-rhel8",
          "rhacm-2:rhacm2/grc-ui-rhel8",
          "rhacm-2:rhacm2/mcm-topology-api-rhel8",
          "rhacm-2:rhacm2/search-ui-rhel8",
          "rhacm-2:search-api.src",
          "rhacm-2:search-ui.src"
        ],
        "known_not_affected": [
          "rhacm-2:rhacm2/application-ui-rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3805"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3805"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3805"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "rhacm-2:rhacm2/console-api-rhel8",
            "rhacm-2:rhacm2/grc-ui-rhel8",
            "rhacm-2:rhacm2/mcm-topology-api-rhel8",
            "rhacm-2:rhacm2/search-ui-rhel8",
            "rhacm-2:search-ui.src"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Out of support scope",
          "product_ids": [
            "maistra-1.1.3:servicemesh-prometheus",
            "maistra-1.1.3:servicemesh-prometheus.src"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "ossm-2.0:servicemesh-prometheus",
            "ossm-2.0:servicemesh-prometheus.src",
            "rhacm-2:search-api.src"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2021-10-20T03:54:29+00:00",
          "details": "Apply advisory RHSA-2021:3925 as per vendors instructions.",
          "product_ids": [
            "rhacm-2.3::el8:grc-ui-api-container-v2.3.3-0:5",
            "rhacm-2.3::el8:search-api-container-v2.3.3-0:5",
            "rhacm-2.3::el8:search-ui-container-v2.3.3-0:7"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2021:3925"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          },
          "products": [
            "maistra-1.1.3:servicemesh-prometheus",
            "maistra-1.1.3:servicemesh-prometheus.src",
            "ossm-2.0:servicemesh-prometheus",
            "ossm-2.0:servicemesh-prometheus.src",
            "rhacm-2.3::el8:grc-ui-api-container-v2.3.3-0:5",
            "rhacm-2.3::el8:search-api-container-v2.3.3-0:5",
            "rhacm-2.3::el8:search-ui-container-v2.3.3-0:7",
            "rhacm-2:rhacm2/application-ui-rhel8",
            "rhacm-2:rhacm2/console-api-rhel8",
            "rhacm-2:rhacm2/grc-ui-rhel8",
            "rhacm-2:rhacm2/mcm-topology-api-rhel8",
            "rhacm-2:rhacm2/search-ui-rhel8",
            "rhacm-2:search-api.src",
            "rhacm-2:search-ui.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low",
          "product_ids": [
            "rhacm-2:rhacm2/application-ui-rhel8",
            "rhacm-2:rhacm2/console-api-rhel8",
            "rhacm-2:rhacm2/grc-ui-rhel8",
            "rhacm-2:rhacm2/mcm-topology-api-rhel8",
            "rhacm-2:rhacm2/search-ui-rhel8",
            "rhacm-2:search-api.src",
            "rhacm-2:search-ui.src"
          ]
        },
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "maistra-1.1.3:servicemesh-prometheus",
            "maistra-1.1.3:servicemesh-prometheus.src",
            "ossm-2.0:servicemesh-prometheus",
            "ossm-2.0:servicemesh-prometheus.src",
            "rhacm-2.3::el8:grc-ui-api-container-v2.3.3-0:5",
            "rhacm-2.3::el8:search-api-container-v2.3.3-0:5",
            "rhacm-2.3::el8:search-ui-container-v2.3.3-0:7"
          ]
        }
      ],
      "title": "prototype pollution vulnerability"
    }
  ]
}