VDB
RHSA-2023%3A5007
RHSA-2023%3A5007
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in Mongo. Specific cstrings input may not be properly validated in the MongoDB Go Driver when marshaling Go objects into BSON. This flaw allows a malicious user to use a Go object with a specific string to inject additional fields into marshaled documents.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-csi-node-driver-registrar-rhel8@sha256:2d43ce0a92a88bd981e94d0cbc74780a0752aa93e078b004d0f14120adbe1553_s390x as a component of Red Hat OpenShift Container Platform 4.14 | *, *, * |
| Red Hat | openshift4/ose-csi-node-driver-registrar@sha256:9391e1e6fca3aaeb8f0cdc955e71c7152b7e8f13b9b40311420f08fb9f705b13_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-csi-node-driver-registrar@sha256:9391e1e6fca3aaeb8f0cdc955e71c7152b7e8f13b9b40311420f08fb9f705b13_amd64, *, * |
| Red Hat | openshift4/ose-clusterresourceoverride-rhel8@sha256:450a5c0738928cabb391f9a4aa4805abff314a7d4eef69230781fcacf28b8ea9_s390x as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-clusterresourceoverride-rhel8@sha256:450a5c0738928cabb391f9a4aa4805abff314a7d4eef69230781fcacf28b8ea9_s390x, openshift4/ose-clusterresourceoverride-rhel8@sha256:450a5c0738928cabb391f9a4aa4805abff314a7d4eef69230781fcacf28b8ea9_s390x, * |
| Red Hat | openshift4/ose-csi-external-snapshotter@sha256:e38020f587997cad9bb0cef61c3389155cbd5554be5fcfc5428fab4c1194a9d4_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | *, *, * |
| Red Hat | openshift4/metallb-rhel8-operator@sha256:19cf9af85f4aeac0c0a54fabffee07447605d1ef565359338da4c5e0c3d46664_s390x as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/metallb-rhel8-operator@sha256:19cf9af85f4aeac0c0a54fabffee07447605d1ef565359338da4c5e0c3d46664_s390x, openshift4/metallb-rhel8-operator@sha256:19cf9af85f4aeac0c0a54fabffee07447605d1ef565359338da4c5e0c3d46664_s390x, * |
| Red Hat | openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:b5d05f8292b62a1e5afe2074edea0aec08b1182e72402cad25f1c3a4103d3a42_s390x as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:b5d05f8292b62a1e5afe2074edea0aec08b1182e72402cad25f1c3a4103d3a42_s390x, openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:b5d05f8292b62a1e5afe2074edea0aec08b1182e72402cad25f1c3a4103d3a42_s390x, openshift4/ose-clusterresourceoverride-rhel8-operator@sha256:b5d05f8292b62a1e5afe2074edea0aec08b1182e72402cad25f1c3a4103d3a42_s390x |
| Red Hat | openshift4/ose-sriov-dp-admission-controller@sha256:883780c79e5763b0f1b47d0e4ee61d71d9da727a17e9350caf877ba30a0fe7e0_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-sriov-dp-admission-controller@sha256:883780c79e5763b0f1b47d0e4ee61d71d9da727a17e9350caf877ba30a0fe7e0_arm64, openshift4/ose-sriov-dp-admission-controller@sha256:883780c79e5763b0f1b47d0e4ee61d71d9da727a17e9350caf877ba30a0fe7e0_arm64, * |
| Red Hat | openshift4/ose-descheduler@sha256:accdfde800c111792d95e3f1927845c1f6591197eae9744cc77ef0e7d03c0e65_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-descheduler@sha256:accdfde800c111792d95e3f1927845c1f6591197eae9744cc77ef0e7d03c0e65_amd64, openshift4/ose-descheduler@sha256:accdfde800c111792d95e3f1927845c1f6591197eae9744cc77ef0e7d03c0e65_amd64, * |
| Red Hat | openshift4/ose-sriov-network-operator-bundle@sha256:5e4ef5c30d5ed02c8c40cefa489e56d61dff260c0a9dc375fd3eeef5d1649243_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-sriov-network-operator-bundle@sha256:5e4ef5c30d5ed02c8c40cefa489e56d61dff260c0a9dc375fd3eeef5d1649243_amd64, openshift4/ose-sriov-network-operator-bundle@sha256:5e4ef5c30d5ed02c8c40cefa489e56d61dff260c0a9dc375fd3eeef5d1649243_amd64 |
| Red Hat | openshift4/ose-ptp-rhel9@sha256:13e4ec3e2848ce81c6dcb3e2cbaa6c577e40b91ef26b904bcb720767875ea1c3_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-ptp-rhel9@sha256:13e4ec3e2848ce81c6dcb3e2cbaa6c577e40b91ef26b904bcb720767875ea1c3_ppc64le, openshift4/ose-ptp-rhel9@sha256:13e4ec3e2848ce81c6dcb3e2cbaa6c577e40b91ef26b904bcb720767875ea1c3_ppc64le |
| Red Hat | openshift4/ose-csi-external-snapshotter@sha256:c8e6d36e96964a14fa8ee15318f2fa4ab282b8562d87d3f69364741d3362aa8e_s390x as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-csi-external-snapshotter@sha256:c8e6d36e96964a14fa8ee15318f2fa4ab282b8562d87d3f69364741d3362aa8e_s390x, openshift4/ose-csi-external-snapshotter@sha256:c8e6d36e96964a14fa8ee15318f2fa4ab282b8562d87d3f69364741d3362aa8e_s390x, openshift4/ose-csi-external-snapshotter@sha256:c8e6d36e96964a14fa8ee15318f2fa4ab282b8562d87d3f69364741d3362aa8e_s390x |
| Red Hat | openshift4/ose-kube-rbac-proxy@sha256:8db8a3708497fb6a8ef42faaa1bcc131af33347bc5960d368d401b77d5d9ba74_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-kube-rbac-proxy@sha256:8db8a3708497fb6a8ef42faaa1bcc131af33347bc5960d368d401b77d5d9ba74_amd64, *, * |
| Red Hat | openshift4/ose-secrets-store-csi-driver-operator-bundle@sha256:981b7ee685cd71d8279a0d2923618f836011dc9bde604d43a459994fca067a85_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-secrets-store-csi-driver-operator-bundle@sha256:981b7ee685cd71d8279a0d2923618f836011dc9bde604d43a459994fca067a85_amd64, openshift4/ose-secrets-store-csi-driver-operator-bundle@sha256:981b7ee685cd71d8279a0d2923618f836011dc9bde604d43a459994fca067a85_amd64, openshift4/ose-secrets-store-csi-driver-operator-bundle@sha256:981b7ee685cd71d8279a0d2923618f836011dc9bde604d43a459994fca067a85_amd64 |
| Red Hat | openshift4/kubernetes-nmstate-operator-bundle@sha256:ca9540f74597f78216380c16c0477561806f7658649073801554b77b4b44ec28_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/kubernetes-nmstate-operator-bundle@sha256:ca9540f74597f78216380c16c0477561806f7658649073801554b77b4b44ec28_amd64, openshift4/kubernetes-nmstate-operator-bundle@sha256:ca9540f74597f78216380c16c0477561806f7658649073801554b77b4b44ec28_amd64 |
| Red Hat | openshift4/ose-cluster-kube-descheduler-operator@sha256:4a4886de01259cf77595b22debf980021b19d479e8776bb7a034809170f24eab_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-cluster-kube-descheduler-operator@sha256:4a4886de01259cf77595b22debf980021b19d479e8776bb7a034809170f24eab_arm64, openshift4/ose-cluster-kube-descheduler-operator@sha256:4a4886de01259cf77595b22debf980021b19d479e8776bb7a034809170f24eab_arm64 |
| Red Hat | openshift4/ose-csi-livenessprobe@sha256:ab30d5596fd0ce97d0cf9a2bf924a20ae08900ad6a24672c5d5c49804dd69232_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | *, *, openshift4/ose-csi-livenessprobe@sha256:ab30d5596fd0ce97d0cf9a2bf924a20ae08900ad6a24672c5d5c49804dd69232_amd64 |
| Red Hat | openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:f2c38d215c0eef37d46fa1438b744deb67bbb620dc3be48dc08bb4f1c67655cf_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:f2c38d215c0eef37d46fa1438b744deb67bbb620dc3be48dc08bb4f1c67655cf_amd64, openshift4/ose-gcp-filestore-csi-driver-rhel8@sha256:f2c38d215c0eef37d46fa1438b744deb67bbb620dc3be48dc08bb4f1c67655cf_amd64 |
| Red Hat | openshift4/cloud-event-proxy-rhel8@sha256:6f3bce3913484baec69d840084264f523b4ec2d895f18adb59f44c4fb2cddb97_arm64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/cloud-event-proxy-rhel8@sha256:6f3bce3913484baec69d840084264f523b4ec2d895f18adb59f44c4fb2cddb97_arm64, openshift4/cloud-event-proxy-rhel8@sha256:6f3bce3913484baec69d840084264f523b4ec2d895f18adb59f44c4fb2cddb97_arm64, openshift4/cloud-event-proxy-rhel8@sha256:6f3bce3913484baec69d840084264f523b4ec2d895f18adb59f44c4fb2cddb97_arm64 |
| Red Hat | openshift4/ose-csi-external-snapshotter-rhel8@sha256:e38020f587997cad9bb0cef61c3389155cbd5554be5fcfc5428fab4c1194a9d4_ppc64le as a component of Red Hat OpenShift Container Platform 4.14 | *, openshift4/ose-csi-external-snapshotter-rhel8@sha256:e38020f587997cad9bb0cef61c3389155cbd5554be5fcfc5428fab4c1194a9d4_ppc64le, openshift4/ose-csi-external-snapshotter-rhel8@sha256:e38020f587997cad9bb0cef61c3389155cbd5554be5fcfc5428fab4c1194a9d4_ppc64le |
| Red Hat | openshift4/ose-csi-livenessprobe-rhel8@sha256:ab30d5596fd0ce97d0cf9a2bf924a20ae08900ad6a24672c5d5c49804dd69232_amd64 as a component of Red Hat OpenShift Container Platform 4.14 | openshift4/ose-csi-livenessprobe-rhel8@sha256:ab30d5596fd0ce97d0cf9a2bf924a20ae08900ad6a24672c5d5c49804dd69232_amd64, openshift4/ose-csi-livenessprobe-rhel8@sha256:ab30d5596fd0ce97d0cf9a2bf924a20ae08900ad6a24672c5d5c49804dd69232_amd64, * |
…and 379 more
Timeline
- Oct 31, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jun 23, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:5007 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1971033 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2178358 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2224245 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2228689 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5007.json advisory
- https://access.redhat.com/security/cve/CVE-2021-20329 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-20329 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-20329 advisory
- https://github.com/advisories/GHSA-f6mq-5m25-4r72 advisory
- https://github.com/mongodb/mongo-go-driver/releases/tag/v1.5.1 advisory
- https://access.redhat.com/security/cve/CVE-2022-41723 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41723 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41723 advisory
- https://github.com/advisories/GHSA-vvpx-j8f3-3w6h advisory
- https://go.dev/cl/468135 advisory
…and 24 more