{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "title": "ReDoS in chai module",
    "tracking": {
      "current_release_date": "2026-07-28T07:32:37+00:00",
      "generator": {
        "date": "2026-07-28T07:32:37+00:00",
        "engine": {
          "name": "CSAF Generator",
          "version": "3.1.0"
        }
      },
      "id": "CVE-2023-43646",
      "initial_release_date": "2023-09-27T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2026-07-28T07:32:37+00:00",
          "number": "1",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "branches": [
          {
            "category": "product_name",
            "name": "OpenShift Container Platform 4.19",
            "product": {
              "name": "OpenShift Container Platform 4.19",
              "product_id": "openshift-4",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift:4"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Openshift Data Foundations odf-4.18",
            "product": {
              "name": "Red Hat Openshift Data Foundations odf-4.18",
              "product_id": "openshift-data-foundation-4",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift_data_foundation:4"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Openshift Data Foundations odf-4.15",
            "product": {
              "name": "Red Hat Openshift Data Foundations odf-4.15",
              "product_id": "openshift-data-foundation-4.15::el9",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift_data_foundation:4.15::el9"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Openshift Data Foundations odf-4.16",
            "product": {
              "name": "Red Hat Openshift Data Foundations odf-4.16",
              "product_id": "openshift-data-foundation-4.16::el9",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift_data_foundation:4.16::el9"
              }
            }
          },
          {
            "category": "product_name",
            "name": "OpenShift Service Mesh OSSM 2.2.0",
            "product": {
              "name": "OpenShift Service Mesh OSSM 2.2.0",
              "product_id": "ossm-2",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:service_mesh:2"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux 8.10.z",
            "product": {
              "name": "Red Hat Enterprise Linux 8.10.z",
              "product_id": "rhel-8",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:enterprise_linux:8"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Red Hat OpenShift Dev Spaces 3.28.0.GA",
            "product": {
              "name": "Red Hat OpenShift Dev Spaces 3.28.0.GA",
              "product_id": "rhos_devspaces-3",
              "product_identification_helper": {
                "cpe": "cpe:/a:redhat:openshift_devspaces:3"
              }
            }
          },
          {
            "category": "product_version",
            "name": "devspaces/traefik-rhel8",
            "product": {
              "name": "devspaces/traefik-rhel8",
              "product_id": "devspaces/traefik-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/traefik-rhel8?repository_url=registry.redhat.io/devspaces/traefik-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf-console-container-v4.15.0",
            "product": {
              "name": "odf-console-container-v4.15.0",
              "product_id": "odf-console-container-v4.15.0-0:57",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf-console-container-v4.15.0@57?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf-multicluster-console-container-v4.16.0",
            "product": {
              "name": "odf-multicluster-console-container-v4.16.0",
              "product_id": "odf-multicluster-console-container-v4.16.0-0:58",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/odf-multicluster-console-container-v4.16.0@58?epoch=0"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/odf-console-rhel9",
            "product": {
              "name": "odf4/odf-console-rhel9",
              "product_id": "odf4/odf-console-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odf-console-rhel9?repository_url=registry.redhat.io/odf4/odf-console-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "odf4/odf-multicluster-console-rhel9",
            "product": {
              "name": "odf4/odf-multicluster-console-rhel9",
              "product_id": "odf4/odf-multicluster-console-rhel9",
              "product_identification_helper": {
                "purl": "pkg:oci/odf-multicluster-console-rhel9?repository_url=registry.redhat.io/odf4/odf-multicluster-console-rhel9"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift-service-mesh/kiali-rhel8",
            "product": {
              "name": "openshift-service-mesh/kiali-rhel8",
              "product_id": "openshift-service-mesh/kiali-rhel8",
              "product_identification_helper": {
                "purl": "pkg:oci/kiali-rhel8?repository_url=registry.redhat.io/openshift-service-mesh/kiali-rhel8"
              }
            }
          },
          {
            "category": "product_version",
            "name": "openshift4/ose-console",
            "product": {
              "name": "openshift4/ose-console",
              "product_id": "openshift4/ose-console",
              "product_identification_helper": {
                "purl": "pkg:oci/ose-console?repository_url=registry.redhat.io/openshift4/ose-console"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pcs",
            "product": {
              "name": "pcs",
              "product_id": "pcs",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pcs"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pcs-snmp",
            "product": {
              "name": "pcs-snmp",
              "product_id": "pcs-snmp",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pcs-snmp"
              }
            }
          },
          {
            "category": "product_version",
            "name": "pcs",
            "product": {
              "name": "pcs",
              "product_id": "pcs.src",
              "product_identification_helper": {
                "purl": "pkg:rpm/redhat/pcs?arch=src"
              }
            }
          }
        ]
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "devspaces/traefik-rhel8 as a component of Red Hat OpenShift Dev Spaces 3.28.0.GA",
          "product_id": "rhos_devspaces-3:devspaces/traefik-rhel8"
        },
        "product_reference": "devspaces/traefik-rhel8",
        "relates_to_product_reference": "rhos_devspaces-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf-console-container-v4.15.0-0:57 as a component of Red Hat Openshift Data Foundations odf-4.15",
          "product_id": "openshift-data-foundation-4.15::el9:odf-console-container-v4.15.0-0:57"
        },
        "product_reference": "odf-console-container-v4.15.0-0:57",
        "relates_to_product_reference": "openshift-data-foundation-4.15::el9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf-multicluster-console-container-v4.16.0-0:58 as a component of Red Hat Openshift Data Foundations odf-4.16",
          "product_id": "openshift-data-foundation-4.16::el9:odf-multicluster-console-container-v4.16.0-0:58"
        },
        "product_reference": "odf-multicluster-console-container-v4.16.0-0:58",
        "relates_to_product_reference": "openshift-data-foundation-4.16::el9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/odf-console-rhel9 as a component of Red Hat Openshift Data Foundations odf-4.18",
          "product_id": "openshift-data-foundation-4:odf4/odf-console-rhel9"
        },
        "product_reference": "odf4/odf-console-rhel9",
        "relates_to_product_reference": "openshift-data-foundation-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "odf4/odf-multicluster-console-rhel9 as a component of Red Hat Openshift Data Foundations odf-4.18",
          "product_id": "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel9"
        },
        "product_reference": "odf4/odf-multicluster-console-rhel9",
        "relates_to_product_reference": "openshift-data-foundation-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift-service-mesh/kiali-rhel8 as a component of OpenShift Service Mesh OSSM 2.2.0",
          "product_id": "ossm-2:openshift-service-mesh/kiali-rhel8"
        },
        "product_reference": "openshift-service-mesh/kiali-rhel8",
        "relates_to_product_reference": "ossm-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-console as a component of OpenShift Container Platform 4.19",
          "product_id": "openshift-4:openshift4/ose-console"
        },
        "product_reference": "openshift4/ose-console",
        "relates_to_product_reference": "openshift-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:pcs"
        },
        "product_reference": "pcs",
        "relates_to_product_reference": "rhel-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs-snmp as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:pcs-snmp"
        },
        "product_reference": "pcs-snmp",
        "relates_to_product_reference": "rhel-8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "pcs.src as a component of Red Hat Enterprise Linux 8.10.z",
          "product_id": "rhel-8:pcs.src"
        },
        "product_reference": "pcs.src",
        "relates_to_product_reference": "rhel-8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-43646",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2023-09-28T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "rhel-8:pcs",
            "rhel-8:pcs-snmp",
            "rhel-8:pcs.src"
          ]
        }
      ],
      "notes": [
        {
          "category": "other",
          "text": "- This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input: '\\t'.repeat(54773) + '\\t/function/i'\n\n-  The get-func-name package is a build-time dependency in Red Hat products, which reduces the chance of successful exploitation. Hence, the impact is set to Moderate.",
          "title": "Statement"
        },
        {
          "category": "description",
          "text": "A vulnerability was found in the get-func-name package in the chai module. Affected versions of this package are vulnerable to Regular expression denial of service (ReDoS) attacks, affecting system availability.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "openshift-data-foundation-4.15::el9:odf-console-container-v4.15.0-0:57",
          "openshift-data-foundation-4.16::el9:odf-multicluster-console-container-v4.16.0-0:58"
        ],
        "known_affected": [
          "openshift-4:openshift4/ose-console",
          "openshift-data-foundation-4:odf4/odf-console-rhel9",
          "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel9",
          "ossm-2:openshift-service-mesh/kiali-rhel8",
          "rhos_devspaces-3:devspaces/traefik-rhel8"
        ],
        "known_not_affected": [
          "rhel-8:pcs",
          "rhel-8:pcs-snmp",
          "rhel-8:pcs.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-43646"
        },
        {
          "category": "external",
          "summary": "nvd.nist.gov",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43646"
        },
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-43646"
        }
      ],
      "remediations": [
        {
          "category": "no_fix_planned",
          "details": "Will not fix",
          "product_ids": [
            "openshift-4:openshift4/ose-console"
          ]
        },
        {
          "category": "none_available",
          "details": "Affected",
          "product_ids": [
            "openshift-data-foundation-4:odf4/odf-console-rhel9",
            "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel9",
            "ossm-2:openshift-service-mesh/kiali-rhel8",
            "rhos_devspaces-3:devspaces/traefik-rhel8"
          ]
        },
        {
          "category": "vendor_fix",
          "date": "2024-03-19T15:19:34+00:00",
          "details": "Apply advisory RHSA-2024:1383 as per vendors instructions.",
          "product_ids": [
            "openshift-data-foundation-4.15::el9:odf-console-container-v4.15.0-0:57"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:1383"
        },
        {
          "category": "vendor_fix",
          "date": "2024-07-17T13:09:39+00:00",
          "details": "Apply advisory RHSA-2024:4591 as per vendors instructions.",
          "product_ids": [
            "openshift-data-foundation-4.16::el9:odf-multicluster-console-container-v4.16.0-0:58"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:4591"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "baseScore": 7.5,
            "baseSeverity": "HIGH"
          },
          "products": [
            "openshift-4:openshift4/ose-console",
            "openshift-data-foundation-4.15::el9:odf-console-container-v4.15.0-0:57",
            "openshift-data-foundation-4.16::el9:odf-multicluster-console-container-v4.16.0-0:58",
            "openshift-data-foundation-4:odf4/odf-console-rhel9",
            "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel9",
            "ossm-2:openshift-service-mesh/kiali-rhel8",
            "rhel-8:pcs",
            "rhel-8:pcs-snmp",
            "rhel-8:pcs.src",
            "rhos_devspaces-3:devspaces/traefik-rhel8"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate",
          "product_ids": [
            "openshift-4:openshift4/ose-console",
            "openshift-data-foundation-4.15::el9:odf-console-container-v4.15.0-0:57",
            "openshift-data-foundation-4.16::el9:odf-multicluster-console-container-v4.16.0-0:58",
            "openshift-data-foundation-4:odf4/odf-console-rhel9",
            "openshift-data-foundation-4:odf4/odf-multicluster-console-rhel9",
            "ossm-2:openshift-service-mesh/kiali-rhel8",
            "rhel-8:pcs",
            "rhel-8:pcs-snmp",
            "rhel-8:pcs.src",
            "rhos_devspaces-3:devspaces/traefik-rhel8"
          ]
        }
      ],
      "title": "ReDoS in chai module"
    }
  ]
}