{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10732.json" } ], "title": "decompress: Decompress: Arbitrary file write leading to remote code execution via crafted ZIP archive (Zip Slip)", "tracking": { "current_release_date": "2026-09-04T19:40:13+00:00", "generator": { "date": "2026-09-04T19:40:13+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.16" } }, "id": "CVE-2026-10732", "initial_release_date": "2026-06-05T05:00:02.896000+00:00", "revision_history": [ { "date": "2026-06-05T05:00:02.896000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-08-10T11:00:52.758843+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-09-04T19:40:13+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Advanced Cluster Management for Kubernetes 2", "product": { "name": "Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2", "product_identification_helper": { "cpe": "cpe:/a:redhat:acm:2" } } } ], "category": "product_family", "name": "Red Hat Advanced Cluster Management for Kubernetes 2" }, { "branches": [ { "category": "product_name", "name": "Red Hat Build of Keycloak", "product": { "name": "Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak", "product_identification_helper": { "cpe": "cpe:/a:redhat:build_keycloak:" } } } ], "category": "product_family", "name": "Red Hat Build of Keycloak" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux 8", "product": { "name": "Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux 8" }, { "branches": [ { "category": "product_name", "name": "Red Hat Hardened Images", "product": { "name": "Red Hat Hardened Images", "product_id": "red_hat_hardened_images", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_family", "name": "Red Hat Hardened Images" }, { "category": "product_version", "name": "redhat-user-workloads/volsync-0-12", "product": { "name": "redhat-user-workloads/volsync-0-12", "product_id": "redhat-user-workloads/volsync-0-12", "product_identification_helper": { "purl": "pkg:oci/volsync-0-12?repository_url=quay.io/redhat-user-workloads/volsync-tenant/volsync-0-12" } } }, { "category": "product_version", "name": "redhat-user-workloads/volsync-bundle-0-12", "product": { "name": "redhat-user-workloads/volsync-bundle-0-12", "product_id": "redhat-user-workloads/volsync-bundle-0-12", "product_identification_helper": { "purl": "pkg:oci/volsync-bundle-0-12?repository_url=quay.io/redhat-user-workloads/volsync-tenant/volsync-bundle-0-12" } } }, { "category": "product_version", "name": "rhacm2/volsync-operator-bundle", "product": { "name": "rhacm2/volsync-operator-bundle", "product_id": "rhacm2/volsync-operator-bundle", "product_identification_helper": { "purl": "pkg:oci/volsync-operator-bundle?repository_url=registry.redhat.io/rhacm2/volsync-operator-bundle" } } }, { "category": "product_version", "name": "rhacm2/volsync-rhel9", "product": { "name": "rhacm2/volsync-rhel9", "product_id": "rhacm2/volsync-rhel9", "product_identification_helper": { "purl": "pkg:oci/volsync-rhel9?repository_url=registry.redhat.io/rhacm2/volsync-rhel9" } } }, { "category": "product_version", "name": "decompress", "product": { "name": "decompress", "product_id": "decompress", "product_identification_helper": { "purl": "pkg:npm/decompress" } } }, { "category": "product_version", "name": "dotnet-hostfxr-8.0", "product": { "name": "dotnet-hostfxr-8.0", "product_id": "dotnet-hostfxr-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-hostfxr-8.0" } } }, { "category": "product_version", "name": "dotnet-targeting-pack-8.0", "product": { "name": "dotnet-targeting-pack-8.0", "product_id": "dotnet-targeting-pack-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-targeting-pack-8.0" } } }, { "category": "product_version", "name": "aspnetcore-runtime-dbg-8.0", "product": { "name": "aspnetcore-runtime-dbg-8.0", "product_id": "aspnetcore-runtime-dbg-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/aspnetcore-runtime-dbg-8.0" } } }, { "category": "product_version", "name": "aspnetcore-targeting-pack-8.0", "product": { "name": "aspnetcore-targeting-pack-8.0", "product_id": "aspnetcore-targeting-pack-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/aspnetcore-targeting-pack-8.0" } } }, { "category": "product_version", "name": "dotnet", "product": { "name": "dotnet", "product_id": "dotnet", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet" } } }, { "category": "product_version", "name": "dotnet-runtime-dbg-8.0", "product": { "name": "dotnet-runtime-dbg-8.0", "product_id": "dotnet-runtime-dbg-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-runtime-dbg-8.0" } } }, { "category": "product_version", "name": "dotnet-sdk-dbg-8.0", "product": { "name": "dotnet-sdk-dbg-8.0", "product_id": "dotnet-sdk-dbg-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-sdk-dbg-8.0" } } }, { "category": "product_version", "name": "dotnet-sdk-8.0", "product": { "name": "dotnet-sdk-8.0", "product_id": "dotnet-sdk-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-sdk-8.0" } } }, { "category": "product_version", "name": "dotnet8.0.src", "product": { "name": "dotnet8.0.src", "product_id": "dotnet8.0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet8.0?arch=src" } } }, { "category": "product_version", "name": "dotnet-sdk-8.0-source-built-artifacts", "product": { "name": "dotnet-sdk-8.0-source-built-artifacts", "product_id": "dotnet-sdk-8.0-source-built-artifacts", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-sdk-8.0-source-built-artifacts" } } }, { "category": "product_version", "name": "dotnet-apphost-pack-8.0", "product": { "name": "dotnet-apphost-pack-8.0", "product_id": "dotnet-apphost-pack-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-apphost-pack-8.0" } } }, { "category": "product_version", "name": "dotnet-runtime-8.0", "product": { "name": "dotnet-runtime-8.0", "product_id": "dotnet-runtime-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-runtime-8.0" } } }, { "category": "product_version", "name": "netstandard-targeting-pack-2.1", "product": { "name": "netstandard-targeting-pack-2.1", "product_id": "netstandard-targeting-pack-2.1", "product_identification_helper": { "purl": "pkg:rpm/redhat/netstandard-targeting-pack-2.1" } } }, { "category": "product_version", "name": "dotnet-host", "product": { "name": "dotnet-host", "product_id": "dotnet-host", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-host" } } }, { "category": "product_version", "name": "aspnetcore-runtime-8.0", "product": { "name": "aspnetcore-runtime-8.0", "product_id": "aspnetcore-runtime-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/aspnetcore-runtime-8.0" } } }, { "category": "product_version", "name": "dotnet-templates-8.0", "product": { "name": "dotnet-templates-8.0", "product_id": "dotnet-templates-8.0", "product_identification_helper": { "purl": "pkg:rpm/redhat/dotnet-templates-8.0" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "redhat-user-workloads/volsync-0-12 as a component of Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-0-12" }, "product_reference": "redhat-user-workloads/volsync-0-12", "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2" }, { "category": "default_component_of", "full_product_name": { "name": "redhat-user-workloads/volsync-bundle-0-12 as a component of Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-bundle-0-12" }, "product_reference": "redhat-user-workloads/volsync-bundle-0-12", "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/volsync-operator-bundle as a component of Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-operator-bundle" }, "product_reference": "rhacm2/volsync-operator-bundle", "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2" }, { "category": "default_component_of", "full_product_name": { "name": "rhacm2/volsync-rhel9 as a component of Red Hat Advanced Cluster Management for Kubernetes 2", "product_id": "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9" }, "product_reference": "rhacm2/volsync-rhel9", "relates_to_product_reference": "red_hat_advanced_cluster_management_for_kubernetes_2" }, { "category": "default_component_of", "full_product_name": { "name": "decompress as a component of Red Hat Build of Keycloak", "product_id": "red_hat_build_of_keycloak:decompress" }, "product_reference": "decompress", "relates_to_product_reference": "red_hat_build_of_keycloak" }, { "category": "default_component_of", "full_product_name": { "name": "aspnetcore-runtime-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:aspnetcore-runtime-8.0" }, "product_reference": "aspnetcore-runtime-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "aspnetcore-runtime-dbg-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:aspnetcore-runtime-dbg-8.0" }, "product_reference": "aspnetcore-runtime-dbg-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "aspnetcore-targeting-pack-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:aspnetcore-targeting-pack-8.0" }, "product_reference": "aspnetcore-targeting-pack-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet" }, "product_reference": "dotnet", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-apphost-pack-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-apphost-pack-8.0" }, "product_reference": "dotnet-apphost-pack-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-host as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-host" }, "product_reference": "dotnet-host", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-hostfxr-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-hostfxr-8.0" }, "product_reference": "dotnet-hostfxr-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-runtime-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-runtime-8.0" }, "product_reference": "dotnet-runtime-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-runtime-dbg-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-runtime-dbg-8.0" }, "product_reference": "dotnet-runtime-dbg-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-sdk-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-sdk-8.0" }, "product_reference": "dotnet-sdk-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-sdk-8.0-source-built-artifacts as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-sdk-8.0-source-built-artifacts" }, "product_reference": "dotnet-sdk-8.0-source-built-artifacts", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-sdk-dbg-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-sdk-dbg-8.0" }, "product_reference": "dotnet-sdk-dbg-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-targeting-pack-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-targeting-pack-8.0" }, "product_reference": "dotnet-targeting-pack-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet-templates-8.0 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet-templates-8.0" }, "product_reference": "dotnet-templates-8.0", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet8.0.src as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:dotnet8.0.src" }, "product_reference": "dotnet8.0.src", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "netstandard-targeting-pack-2.1 as a component of Red Hat Enterprise Linux 8", "product_id": "red_hat_enterprise_linux_8:netstandard-targeting-pack-2.1" }, "product_reference": "netstandard-targeting-pack-2.1", "relates_to_product_reference": "red_hat_enterprise_linux_8" }, { "category": "default_component_of", "full_product_name": { "name": "dotnet8.0.src as a component of Red Hat Hardened Images", "product_id": "red_hat_hardened_images:dotnet8.0.src" }, "product_reference": "dotnet8.0.src", "relates_to_product_reference": "red_hat_hardened_images" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-10732", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2026-06-05T07:00:56.746862+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-bundle-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-operator-bundle", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9", "red_hat_enterprise_linux_8:aspnetcore-runtime-8.0", "red_hat_enterprise_linux_8:aspnetcore-runtime-dbg-8.0", "red_hat_enterprise_linux_8:aspnetcore-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet", "red_hat_enterprise_linux_8:dotnet-apphost-pack-8.0", "red_hat_enterprise_linux_8:dotnet-host", "red_hat_enterprise_linux_8:dotnet-hostfxr-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0-source-built-artifacts", "red_hat_enterprise_linux_8:dotnet-sdk-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet-templates-8.0", "red_hat_enterprise_linux_8:dotnet8.0.src", "red_hat_enterprise_linux_8:netstandard-targeting-pack-2.1" ] }, { "label": "component_not_present", "product_ids": [ "red_hat_hardened_images:dotnet8.0.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2485376" } ], "notes": [ { "category": "description", "text": "A flaw was found in the decompress package. A remote attacker can exploit this by providing a crafted ZIP archive with two entries at the same path: a symlink to an arbitrary target and a regular file. Due to microtask processing order, the file content is written through the symlink before it is resolved, allowing writes outside the output directory. This Zip Slip bypasses path traversal protections including preventWritingThroughSymlink (CVE-2020-12265) and can lead to remote code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "decompress: Decompress: Arbitrary file write leading to remote code execution via crafted ZIP archive (Zip Slip)", "title": "Vulnerability summary" }, { "category": "other", "text": "The decompress package is vulnerable to arbitrary file write via Zip Slip when extracting a crafted ZIP containing a symlink and regular file at the same path. Microtask ordering checks readlink on the second entry before resolving the first symlink, bypassing preventWritingThroughSymlink and prior CVE-2020-12265 protections. An attacker who can supply a malicious archive for extraction may write files outside the intended output directory, potentially leading to remote code execution on the host.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "red_hat_build_of_keycloak:decompress" ], "known_not_affected": [ "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-bundle-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-operator-bundle", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9", "red_hat_enterprise_linux_8:aspnetcore-runtime-8.0", "red_hat_enterprise_linux_8:aspnetcore-runtime-dbg-8.0", "red_hat_enterprise_linux_8:aspnetcore-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet", "red_hat_enterprise_linux_8:dotnet-apphost-pack-8.0", "red_hat_enterprise_linux_8:dotnet-host", "red_hat_enterprise_linux_8:dotnet-hostfxr-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0-source-built-artifacts", "red_hat_enterprise_linux_8:dotnet-sdk-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet-templates-8.0", "red_hat_enterprise_linux_8:dotnet8.0.src", "red_hat_enterprise_linux_8:netstandard-targeting-pack-2.1", "red_hat_hardened_images:dotnet8.0.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-10732" }, { "category": "external", "summary": "RHBZ#2485376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2485376" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10732", "url": "https://www.cve.org/CVERecord?id=CVE-2026-10732" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10732", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10732" }, { "category": "external", "summary": "https://gist.github.com/Alemmi/409c3cc148c39522c6d6a8538b0e1f9e", "url": "https://gist.github.com/Alemmi/409c3cc148c39522c6d6a8538b0e1f9e" }, { "category": "external", "summary": "https://github.com/kevva/decompress/pull/112", "url": "https://github.com/kevva/decompress/pull/112" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-16415209", "url": "https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-16415209" } ], "release_date": "2026-06-05T05:00:02.896000+00:00", "remediations": [ { "category": "no_fix_planned", "details": "Will not fix", "product_ids": [ "red_hat_build_of_keycloak:decompress" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-bundle-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-operator-bundle", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9", "red_hat_build_of_keycloak:decompress", "red_hat_enterprise_linux_8:aspnetcore-runtime-8.0", "red_hat_enterprise_linux_8:aspnetcore-runtime-dbg-8.0", "red_hat_enterprise_linux_8:aspnetcore-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet", "red_hat_enterprise_linux_8:dotnet-apphost-pack-8.0", "red_hat_enterprise_linux_8:dotnet-host", "red_hat_enterprise_linux_8:dotnet-hostfxr-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0-source-built-artifacts", "red_hat_enterprise_linux_8:dotnet-sdk-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet-templates-8.0", "red_hat_enterprise_linux_8:dotnet8.0.src", "red_hat_enterprise_linux_8:netstandard-targeting-pack-2.1", "red_hat_hardened_images:dotnet8.0.src" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:redhat-user-workloads/volsync-bundle-0-12", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-operator-bundle", "red_hat_advanced_cluster_management_for_kubernetes_2:rhacm2/volsync-rhel9", "red_hat_build_of_keycloak:decompress", "red_hat_enterprise_linux_8:aspnetcore-runtime-8.0", "red_hat_enterprise_linux_8:aspnetcore-runtime-dbg-8.0", "red_hat_enterprise_linux_8:aspnetcore-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet", "red_hat_enterprise_linux_8:dotnet-apphost-pack-8.0", "red_hat_enterprise_linux_8:dotnet-host", "red_hat_enterprise_linux_8:dotnet-hostfxr-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-8.0", "red_hat_enterprise_linux_8:dotnet-runtime-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0", "red_hat_enterprise_linux_8:dotnet-sdk-8.0-source-built-artifacts", "red_hat_enterprise_linux_8:dotnet-sdk-dbg-8.0", "red_hat_enterprise_linux_8:dotnet-targeting-pack-8.0", "red_hat_enterprise_linux_8:dotnet-templates-8.0", "red_hat_enterprise_linux_8:dotnet8.0.src", "red_hat_enterprise_linux_8:netstandard-targeting-pack-2.1", "red_hat_hardened_images:dotnet8.0.src" ] } ], "title": "decompress: Decompress: Arbitrary file write leading to remote code execution via crafted ZIP archive (Zip Slip)" } ] }