{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56121.json" } ], "title": "feast: Feast: Remote Code Execution via Unsafe Deserialization in gRPC Registry Server", "tracking": { "current_release_date": "2026-06-30T03:42:40+00:00", "generator": { "date": "2026-06-30T03:42:40+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.3.0" } }, "id": "CVE-2026-56121", "initial_release_date": "2026-06-24T14:49:11.490000+00:00", "revision_history": [ { "date": "2026-06-24T14:49:11.490000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-29T05:06:38+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-30T03:42:40+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)", "product": { "name": "Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai)", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "category": "product_version", "name": "rhoai/odh-feature-server-rhel9", "product": { "name": "rhoai/odh-feature-server-rhel9", "product_id": "rhoai/odh-feature-server-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-feature-server-rhel9?repository_url=registry.redhat.io/rhoai/odh-feature-server-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": { "name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_id": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-pipeline-runtime-datascience-cpu-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": { "name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_id": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-pipeline-runtime-pytorch-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": { "name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_id": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": { "name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_id": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-pipeline-runtime-pytorch-rocm-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": { "name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_id": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": { "name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_id": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": { "name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_id": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-codeserver-datascience-cpu-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": { "name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_id": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": { "name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_id": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-jupyter-pytorch-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": { "name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_id": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": { "name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_id": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-jupyter-pytorch-rocm-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": { "name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_id": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9" } } }, { "category": "product_version", "name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": { "name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_id": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_identification_helper": { "purl": "pkg:oci/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-feature-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9" }, "product_reference": "rhoai/odh-feature-server-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9" }, "product_reference": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9" }, "product_reference": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9" }, "product_reference": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9" }, "product_reference": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9" }, "product_reference": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9" }, "product_reference": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" }, { "category": "default_component_of", "full_product_name": { "name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)", "product_id": "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" }, "product_reference": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "relates_to_product_reference": "red_hat_openshift_ai_(rhoai)" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-56121", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2026-06-24T16:00:57.361750+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2492229" } ], "notes": [ { "category": "description", "text": "A flaw was found in Feast. This vulnerability allows unauthenticated or unauthorized attackers to achieve remote code execution. By sending a specially crafted gRPC request to the registry server, attackers can exploit an unsafe deserialization process. This enables them to execute operating system commands as the Feast service account, leading to a complete compromise of the affected system.", "title": "Vulnerability description" }, { "category": "summary", "text": "feast: Feast: Remote Code Execution via Unsafe Deserialization in gRPC Registry Server", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenShift AI ships Feast versions affected by CVE-2026-56121. This flaw allows remote code execution only against the Feast registry gRPC server (feast serve_registry, port 6570) when that service is running and reachable.\n\nDefault OpenShift AI installations are not affected. Installing OpenShift AI deploys the Feast operator but does not create a FeatureStore instance or start a registry server. The default FeatureStore configuration runs the online feature server only (feast serve), which does not expose the vulnerable gRPC endpoint. Workbench and pipeline runtime images include Feast as a client library and do not start a registry server.\n\nRed Hat validated this by attempting exploitation against Feast 0.62.0: remote code execution succeeded only when a registry server was explicitly started; the default online-only configuration and library-only images were not exploitable.\n\nCustomers who configure a FeatureStore with an explicit registry server (registry.local.server) should treat this as a critical issue and apply the fix (Feast ≥ 0.63.0) when available. Enabling authorization alone does not remediate affected versions because unsafe deserialization occurs before authorization checks.\n\nRed Hat rates this Important for OpenShift AI overall, reflecting that the vulnerable component is present but the attack surface is not exposed under default configurations.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-56121" }, { "category": "external", "summary": "RHBZ#2492229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492229" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56121", "url": "https://www.cve.org/CVERecord?id=CVE-2026-56121" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56121", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56121" }, { "category": "external", "summary": "https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a", "url": "https://github.com/feast-dev/feast/commit/835cda8e2c1359f1f496ad72701dbd6a73bdb25a" }, { "category": "external", "summary": "https://github.com/feast-dev/feast/releases/tag/v0.63.0", "url": "https://github.com/feast-dev/feast/releases/tag/v0.63.0" }, { "category": "external", "summary": "https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6", "url": "https://huntr.com/bounties/d64b8111-180b-46ba-afa3-c877fda2ede6" }, { "category": "external", "summary": "https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization", "url": "https://www.vulncheck.com/advisories/feast-unauthenticated-rce-via-applyfeatureview-grpc-deserialization" } ], "release_date": "2026-06-24T14:49:11.490000+00:00", "remediations": [ { "category": "workaround", "details": "- Restrict network access to Feature Server / registry endpoints (NetworkPolicy, Route auth, no public exposure).\n- Do not expose the Feast registry gRPC port to untrusted networks; place behind OpenShift Route + platform authentication.", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" ] }, { "category": "none_available", "details": "Affected", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" ] } ], "threats": [ { "category": "impact", "details": "Important", "product_ids": [ "red_hat_openshift_ai_(rhoai):rhoai/odh-feature-server-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9" ] } ], "title": "feast: Feast: Remote Code Execution via Unsafe Deserialization in gRPC Registry Server" } ] }