{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "QEMU task driver allowed paths bypass with job args",
    "tracking": {
      "current_release_date": "2026-08-11T15:01:02+00:00",
      "generator": {
        "date": "2026-08-11T15:01:02+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.3.0"
        }
      },
      "id": "CVE-2021-43415",
      "initial_release_date": "2021-11-21T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-08-11T15:01:02+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
              "product_id": "rhacm-2.11.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2.11"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
              "product_id": "rhacm-2.12.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2.12"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
              "product_id": "rhacm-2.13.z",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2.13"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
              "product_id": "rhacm-2.14",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2.14"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
            "product": {
              "name": "Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
              "product_id": "rhacm-2.15",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:acm:2.15"
              }
            }
          },
          {
            "category": "product_version",
            "name": "multicluster-engine",
            "product": {
              "name": "multicluster-engine",
              "product_id": "multicluster-engine.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/multicluster-engine?arch=src"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/cluster-curator-controller-rhel8",
            "product": {
              "name": "rhacm2/cluster-curator-controller-rhel8",
              "product_id": "rhacm2/cluster-curator-controller-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/cluster-curator-controller-rhel8?repository_url=registry.redhat.io/rhacm2/cluster-curator-controller-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/clusterlifecycle-state-metrics-rhel8",
            "product": {
              "name": "rhacm2/clusterlifecycle-state-metrics-rhel8",
              "product_id": "rhacm2/clusterlifecycle-state-metrics-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/clusterlifecycle-state-metrics-rhel8?repository_url=registry.redhat.io/rhacm2/clusterlifecycle-state-metrics-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/multicloud-manager-rhel8",
            "product": {
              "name": "rhacm2/multicloud-manager-rhel8",
              "product_id": "rhacm2/multicloud-manager-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/multicloud-manager-rhel8?repository_url=registry.redhat.io/rhacm2/multicloud-manager-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/multiclusterhub-rhel8",
            "product": {
              "name": "rhacm2/multiclusterhub-rhel8",
              "product_id": "rhacm2/multiclusterhub-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/multiclusterhub-rhel8?repository_url=registry.redhat.io/rhacm2/multiclusterhub-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "rhacm2/openshift-hive-rhel8",
            "product": {
              "name": "rhacm2/openshift-hive-rhel8",
              "product_id": "rhacm2/openshift-hive-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/openshift-hive-rhel8?repository_url=registry.redhat.io/rhacm2/openshift-hive-rhel8"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "multicluster-engine.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
          "product_id": "rhacm-2.15:multicluster-engine.src"
        },
        "product_reference": "multicluster-engine.src",
        "relates_to_product_reference": "rhacm-2.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "multicluster-engine.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
          "product_id": "rhacm-2.14:multicluster-engine.src"
        },
        "product_reference": "multicluster-engine.src",
        "relates_to_product_reference": "rhacm-2.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "multicluster-engine.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
          "product_id": "rhacm-2.12.z:multicluster-engine.src"
        },
        "product_reference": "multicluster-engine.src",
        "relates_to_product_reference": "rhacm-2.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "multicluster-engine.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
          "product_id": "rhacm-2.11.z:multicluster-engine.src"
        },
        "product_reference": "multicluster-engine.src",
        "relates_to_product_reference": "rhacm-2.11.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "multicluster-engine.src as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
          "product_id": "rhacm-2.13.z:multicluster-engine.src"
        },
        "product_reference": "multicluster-engine.src",
        "relates_to_product_reference": "rhacm-2.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/cluster-curator-controller-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
          "product_id": "rhacm-2.12.z:rhacm2/cluster-curator-controller-rhel8"
        },
        "product_reference": "rhacm2/cluster-curator-controller-rhel8",
        "relates_to_product_reference": "rhacm-2.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/cluster-curator-controller-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
          "product_id": "rhacm-2.14:rhacm2/cluster-curator-controller-rhel8"
        },
        "product_reference": "rhacm2/cluster-curator-controller-rhel8",
        "relates_to_product_reference": "rhacm-2.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/cluster-curator-controller-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
          "product_id": "rhacm-2.13.z:rhacm2/cluster-curator-controller-rhel8"
        },
        "product_reference": "rhacm2/cluster-curator-controller-rhel8",
        "relates_to_product_reference": "rhacm-2.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/cluster-curator-controller-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
          "product_id": "rhacm-2.11.z:rhacm2/cluster-curator-controller-rhel8"
        },
        "product_reference": "rhacm2/cluster-curator-controller-rhel8",
        "relates_to_product_reference": "rhacm-2.11.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/cluster-curator-controller-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
          "product_id": "rhacm-2.15:rhacm2/cluster-curator-controller-rhel8"
        },
        "product_reference": "rhacm2/cluster-curator-controller-rhel8",
        "relates_to_product_reference": "rhacm-2.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/clusterlifecycle-state-metrics-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
          "product_id": "rhacm-2.15:rhacm2/clusterlifecycle-state-metrics-rhel8"
        },
        "product_reference": "rhacm2/clusterlifecycle-state-metrics-rhel8",
        "relates_to_product_reference": "rhacm-2.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/clusterlifecycle-state-metrics-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
          "product_id": "rhacm-2.12.z:rhacm2/clusterlifecycle-state-metrics-rhel8"
        },
        "product_reference": "rhacm2/clusterlifecycle-state-metrics-rhel8",
        "relates_to_product_reference": "rhacm-2.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/clusterlifecycle-state-metrics-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
          "product_id": "rhacm-2.14:rhacm2/clusterlifecycle-state-metrics-rhel8"
        },
        "product_reference": "rhacm2/clusterlifecycle-state-metrics-rhel8",
        "relates_to_product_reference": "rhacm-2.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/clusterlifecycle-state-metrics-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
          "product_id": "rhacm-2.13.z:rhacm2/clusterlifecycle-state-metrics-rhel8"
        },
        "product_reference": "rhacm2/clusterlifecycle-state-metrics-rhel8",
        "relates_to_product_reference": "rhacm-2.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/clusterlifecycle-state-metrics-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
          "product_id": "rhacm-2.11.z:rhacm2/clusterlifecycle-state-metrics-rhel8"
        },
        "product_reference": "rhacm2/clusterlifecycle-state-metrics-rhel8",
        "relates_to_product_reference": "rhacm-2.11.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multicloud-manager-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
          "product_id": "rhacm-2.11.z:rhacm2/multicloud-manager-rhel8"
        },
        "product_reference": "rhacm2/multicloud-manager-rhel8",
        "relates_to_product_reference": "rhacm-2.11.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multicloud-manager-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
          "product_id": "rhacm-2.15:rhacm2/multicloud-manager-rhel8"
        },
        "product_reference": "rhacm2/multicloud-manager-rhel8",
        "relates_to_product_reference": "rhacm-2.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multicloud-manager-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
          "product_id": "rhacm-2.14:rhacm2/multicloud-manager-rhel8"
        },
        "product_reference": "rhacm2/multicloud-manager-rhel8",
        "relates_to_product_reference": "rhacm-2.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multicloud-manager-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
          "product_id": "rhacm-2.12.z:rhacm2/multicloud-manager-rhel8"
        },
        "product_reference": "rhacm2/multicloud-manager-rhel8",
        "relates_to_product_reference": "rhacm-2.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multicloud-manager-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
          "product_id": "rhacm-2.13.z:rhacm2/multicloud-manager-rhel8"
        },
        "product_reference": "rhacm2/multicloud-manager-rhel8",
        "relates_to_product_reference": "rhacm-2.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multiclusterhub-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
          "product_id": "rhacm-2.11.z:rhacm2/multiclusterhub-rhel8"
        },
        "product_reference": "rhacm2/multiclusterhub-rhel8",
        "relates_to_product_reference": "rhacm-2.11.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multiclusterhub-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
          "product_id": "rhacm-2.15:rhacm2/multiclusterhub-rhel8"
        },
        "product_reference": "rhacm2/multiclusterhub-rhel8",
        "relates_to_product_reference": "rhacm-2.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multiclusterhub-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
          "product_id": "rhacm-2.12.z:rhacm2/multiclusterhub-rhel8"
        },
        "product_reference": "rhacm2/multiclusterhub-rhel8",
        "relates_to_product_reference": "rhacm-2.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multiclusterhub-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
          "product_id": "rhacm-2.14:rhacm2/multiclusterhub-rhel8"
        },
        "product_reference": "rhacm2/multiclusterhub-rhel8",
        "relates_to_product_reference": "rhacm-2.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/multiclusterhub-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
          "product_id": "rhacm-2.13.z:rhacm2/multiclusterhub-rhel8"
        },
        "product_reference": "rhacm2/multiclusterhub-rhel8",
        "relates_to_product_reference": "rhacm-2.13.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/openshift-hive-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.11.0",
          "product_id": "rhacm-2.11.z:rhacm2/openshift-hive-rhel8"
        },
        "product_reference": "rhacm2/openshift-hive-rhel8",
        "relates_to_product_reference": "rhacm-2.11.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/openshift-hive-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.15.0",
          "product_id": "rhacm-2.15:rhacm2/openshift-hive-rhel8"
        },
        "product_reference": "rhacm2/openshift-hive-rhel8",
        "relates_to_product_reference": "rhacm-2.15"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/openshift-hive-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.12.0",
          "product_id": "rhacm-2.12.z:rhacm2/openshift-hive-rhel8"
        },
        "product_reference": "rhacm2/openshift-hive-rhel8",
        "relates_to_product_reference": "rhacm-2.12.z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/openshift-hive-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.14.0",
          "product_id": "rhacm-2.14:rhacm2/openshift-hive-rhel8"
        },
        "product_reference": "rhacm2/openshift-hive-rhel8",
        "relates_to_product_reference": "rhacm-2.14"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhacm2/openshift-hive-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes ACM 2.13.0",
          "product_id": "rhacm-2.13.z:rhacm2/openshift-hive-rhel8"
        },
        "product_reference": "rhacm2/openshift-hive-rhel8",
        "relates_to_product_reference": "rhacm-2.13.z"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-43415",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2021-12-03T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhacm-2.11.z:multicluster-engine.src",
            "rhacm-2.11.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.11.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.11.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.11.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.11.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.12.z:multicluster-engine.src",
            "rhacm-2.12.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.12.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.12.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.12.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.12.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.13.z:multicluster-engine.src",
            "rhacm-2.13.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.13.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.13.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.13.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.13.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.14:multicluster-engine.src",
            "rhacm-2.14:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.14:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.14:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.14:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.14:rhacm2/openshift-hive-rhel8",
            "rhacm-2.15:multicluster-engine.src",
            "rhacm-2.15:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.15:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.15:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.15:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.15:rhacm2/openshift-hive-rhel8"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "rhacm-2.11.z:multicluster-engine.src",
          "rhacm-2.11.z:rhacm2/cluster-curator-controller-rhel8",
          "rhacm-2.11.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
          "rhacm-2.11.z:rhacm2/multicloud-manager-rhel8",
          "rhacm-2.11.z:rhacm2/multiclusterhub-rhel8",
          "rhacm-2.11.z:rhacm2/openshift-hive-rhel8",
          "rhacm-2.12.z:multicluster-engine.src",
          "rhacm-2.12.z:rhacm2/cluster-curator-controller-rhel8",
          "rhacm-2.12.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
          "rhacm-2.12.z:rhacm2/multicloud-manager-rhel8",
          "rhacm-2.12.z:rhacm2/multiclusterhub-rhel8",
          "rhacm-2.12.z:rhacm2/openshift-hive-rhel8",
          "rhacm-2.13.z:multicluster-engine.src",
          "rhacm-2.13.z:rhacm2/cluster-curator-controller-rhel8",
          "rhacm-2.13.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
          "rhacm-2.13.z:rhacm2/multicloud-manager-rhel8",
          "rhacm-2.13.z:rhacm2/multiclusterhub-rhel8",
          "rhacm-2.13.z:rhacm2/openshift-hive-rhel8",
          "rhacm-2.14:multicluster-engine.src",
          "rhacm-2.14:rhacm2/cluster-curator-controller-rhel8",
          "rhacm-2.14:rhacm2/clusterlifecycle-state-metrics-rhel8",
          "rhacm-2.14:rhacm2/multicloud-manager-rhel8",
          "rhacm-2.14:rhacm2/multiclusterhub-rhel8",
          "rhacm-2.14:rhacm2/openshift-hive-rhel8",
          "rhacm-2.15:multicluster-engine.src",
          "rhacm-2.15:rhacm2/cluster-curator-controller-rhel8",
          "rhacm-2.15:rhacm2/clusterlifecycle-state-metrics-rhel8",
          "rhacm-2.15:rhacm2/multicloud-manager-rhel8",
          "rhacm-2.15:rhacm2/multiclusterhub-rhel8",
          "rhacm-2.15:rhacm2/openshift-hive-rhel8"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-43415"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43415"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-43415"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "baseScore": 8.8,
            "baseSeverity": "HIGH"
          },
          "products": [
            "rhacm-2.11.z:multicluster-engine.src",
            "rhacm-2.11.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.11.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.11.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.11.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.11.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.12.z:multicluster-engine.src",
            "rhacm-2.12.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.12.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.12.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.12.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.12.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.13.z:multicluster-engine.src",
            "rhacm-2.13.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.13.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.13.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.13.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.13.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.14:multicluster-engine.src",
            "rhacm-2.14:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.14:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.14:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.14:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.14:rhacm2/openshift-hive-rhel8",
            "rhacm-2.15:multicluster-engine.src",
            "rhacm-2.15:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.15:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.15:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.15:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.15:rhacm2/openshift-hive-rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "rhacm-2.11.z:multicluster-engine.src",
            "rhacm-2.11.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.11.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.11.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.11.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.11.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.12.z:multicluster-engine.src",
            "rhacm-2.12.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.12.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.12.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.12.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.12.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.13.z:multicluster-engine.src",
            "rhacm-2.13.z:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.13.z:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.13.z:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.13.z:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.13.z:rhacm2/openshift-hive-rhel8",
            "rhacm-2.14:multicluster-engine.src",
            "rhacm-2.14:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.14:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.14:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.14:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.14:rhacm2/openshift-hive-rhel8",
            "rhacm-2.15:multicluster-engine.src",
            "rhacm-2.15:rhacm2/cluster-curator-controller-rhel8",
            "rhacm-2.15:rhacm2/clusterlifecycle-state-metrics-rhel8",
            "rhacm-2.15:rhacm2/multicloud-manager-rhel8",
            "rhacm-2.15:rhacm2/multiclusterhub-rhel8",
            "rhacm-2.15:rhacm2/openshift-hive-rhel8"
          ]
        }
      ],
      "title": "QEMU task driver allowed paths bypass with job args"
    }
  ]
}