BlackTreeIndependent security intelligence
← Back to the CVE catalogue
Full vulnerability report · 2025
CVE-2022-49043High confidence

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free

xmlsoft · libxml2

8.1HighCVSS 3.1
Recommended action
Within 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Patch available
Distribution package intelligence

Ubuntu vendor package status

Canonical’s release and source-package findings are shown separately from local repository availability.

1 package state
Repository candidate not checked

A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.

Ubuntu releaseSource packageVendor stateFixed versionEvidence
Ubuntu 24.04 LTSnoble · standard archivelibxml2Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree.2.9.14+dfsg-1.3ubuntu3.1Canonical record ↗Source updated 8 Sept 2026
Direct vendor intelligence

Authoritative vendor CSAF and VEX advisories

Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.

1 current
CVE-2022-49043 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitylibxml: use-after-free in xmlXIncludeAddNode
12 known affected

The vendor explicitly identifies these products as affected by this CVE.

  • libxml2 as a component of Red Hat Enterprise Linux 6
  • libxml2-devel as a component of Red Hat Enterprise Linux 6
  • libxml2-python as a component of Red Hat Enterprise Linux 6
  • libxml2-static as a component of Red Hat Enterprise Linux 6
  • libxml2.src as a component of Red Hat Enterprise Linux 6
  • libxml2 as a component of Red Hat Enterprise Linux 7
  • libxml2-devel as a component of Red Hat Enterprise Linux 7
  • libxml2-python as a component of Red Hat Enterprise Linux 7
  • libxml2-static as a component of Red Hat Enterprise Linux 7
  • libxml2.src as a component of Red Hat Enterprise Linux 7
  • libxml2.src as a component of Red Hat JBoss Core Services
  • openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4
Summary
A flaw was found in libxml2 where improper handling of memory allocation failures in `libxml2` can lead to crashes, memory leaks, or inconsistent states. While an attacker cannot directly control allocation failures, they may trigger denial-of-service conditions under extreme system stress.
Remediation
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is: (For x86_64 architecture) The image digest is sha256:07dfb0210dbe48ec222a9ffcad4bcf1e5b7e5e32140f911e753fe90dcfd4cd12 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
Optional official sources

National CERT insights
?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.

Select the national-authority views to include. The exact source language is shown on each matched advisory. Your choice is remembered on this device and encoded in the shareable URL.

Official European source

ENISA European Vulnerability Database

Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.

1 current
ENISA EUVD identifier

EUVD-2022-53920

No EUVD known-exploited evidence

ENISA has published the identifier mapping but no EUVD description has been stored yet.

EUVD state
Present in the current official mapping
Known exploitation
Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score
Not supplied in the stored EUVD record
Advisory evidence
No linked advisory details stored yet
Recommended actionWithin 7 days

High technical severity; prioritise exposed affected systems while verifying vendor guidance.

Patch available
01

What, why and how

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

What

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

Why

The program can continue using memory after it has been released, producing unsafe and attacker-influenceable behaviour.

How

An attacker operating through local access may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

What

xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.

Why

The program can continue using memory after it has been released, producing unsafe and attacker-influenceable behaviour.

How

An attacker operating through local access may attempt exploitation without authentication or user interaction. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.

02

Exploit reality and attack path

CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.

Observed exploitation
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
No confirmed evidence

No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.

Public PoC / exploit material
?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.
None recorded

No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.

Likely attack path
local access → Use After Free → cause the confidentiality, integrity or availability impact described by the vendor
Attack surface
Local
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
High: exploitation depends on specific conditions
Security boundary
Changed: exploitation can affect a different security authority
Weakness
?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-416 ↗

CWE-416: Use After Free. The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

CVSS vector
?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.

AVLocalAttack vector: The attacker needs local access to the vulnerable system.ACHighAttack complexity: Successful exploitation depends on specific conditions outside the attacker's direct control.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SChangedScope: The attack can affect a component governed by a different security authority.CHighConfidentiality impact: A successful attack can cause a major loss.IHighIntegrity impact: A successful attack can cause a major loss.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land
The issue can support a local privilege or sandbox boundary transition; normal system utilities may then be available in the gained context.
UnauthenticatedCWE-416
A

Official authority intelligence

Only matched European and national findings are included. Language selectors and unavailable sources are omitted.

BSI · German · WID-SEC-W-2025-0194libxml2: Schwachstelle ermöglicht remote Code Execution

Ein lokaler Angreifer kann eine Schwachstelle in libxml2 ausnutzen, um einen Code auszuführen.

Official advisory
CERT-FR · French · CERTFR-2026-AVI-0218Multiples vulnérabilités dans les produits VMware

d?id=CVE-2022-47695 Référence CVE CVE-2022-47696 https://www.cve.org/CVERecord?id=CVE-2022-47696 Référence CVE CVE-2022-48063 https://www.cve.org/CVERecord?id=CVE-2022-48063 Référence CVE CVE-2022-48064 https://www.cve.org/CVERecord?id=CVE-2022-48064 Référence CVE CVE-2022-48065 https://www.cve.org/CVERecord?id=CVE-2022-48065 Référence CVE CVE-2022-48281 https://www.cve.org/CVERecord?id=CVE-2022-48281 Référence CVE CVE-2022-48303 https://www.cve.org/CVERecord?id=CVE-2022-48303 Référence CVE CVE-2022-48468 https://www.cve.org/CVERecord?id=CVE-2022-48468 Référence CVE CVE-2022-48554 https://www.cve.org/CVERecord?id=CVE-2022-48554 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2022-49063 https://www.cve.org/CVERecord?id=CVE-2022-49063 Référence CVE CVE-2022-49920 https://www.cve.org/CVERecord?id=CVE-2022-49920 Référence CVE CVE-2022-50247 https://www.cve.org/CVERecord?id=CVE-2022-50247 Référence CVE CVE-2022-50249 https://www.cve.org/CVERecord?id=CVE-2022-50249 Référence CVE CVE-2022-50250 https://www.cve.org/CVERecord?id=CVE-2022-50250 Référence CVE CVE-2022-50444 https://www.cve.org/CVERecord?id=CVE-2022-50444 Référence CVE CVE-2022-50458 https://www.cve.org/CVERecord?id=CVE-2022-50458 Référence CVE CVE-2023-0687 https://www.cve.org/CVERecord?id=C

Official advisory
CERT-FR · French · CERTFR-2025-AVI-1057Multiples vulnérabilités dans les produits VMware

d?id=CVE-2022-49015 Référence CVE CVE-2022-49017 https://www.cve.org/CVERecord?id=CVE-2022-49017 Référence CVE CVE-2022-49018 https://www.cve.org/CVERecord?id=CVE-2022-49018 Référence CVE CVE-2022-49021 https://www.cve.org/CVERecord?id=CVE-2022-49021 Référence CVE CVE-2022-49022 https://www.cve.org/CVERecord?id=CVE-2022-49022 Référence CVE CVE-2022-49024 https://www.cve.org/CVERecord?id=CVE-2022-49024 Référence CVE CVE-2022-49027 https://www.cve.org/CVERecord?id=CVE-2022-49027 Référence CVE CVE-2022-49028 https://www.cve.org/CVERecord?id=CVE-2022-49028 Référence CVE CVE-2022-49029 https://www.cve.org/CVERecord?id=CVE-2022-49029 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2022-49048 https://www.cve.org/CVERecord?id=CVE-2022-49048 Référence CVE CVE-2022-49049 https://www.cve.org/CVERecord?id=CVE-2022-49049 Référence CVE CVE-2022-49052 https://www.cve.org/CVERecord?id=CVE-2022-49052 Référence CVE CVE-2022-49057 https://www.cve.org/CVERecord?id=CVE-2022-49057 Référence CVE CVE-2022-49058 https://www.cve.org/CVERecord?id=CVE-2022-49058 Référence CVE CVE-2022-49061 https://www.cve.org/CVERecord?id=CVE-2022-49061 Référence CVE CVE-2022-49062 https://www.cve.org/CVERecord?id=CVE-2022-49062 Référence CVE CVE-2022-49064 https://www.cve.org/CVERecord?id=

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0969Multiples vulnérabilités dans les produits VMware

ecord?id=CVE-2022-45873 Référence CVE CVE-2022-4645 https://www.cve.org/CVERecord?id=CVE-2022-4645 Référence CVE CVE-2022-46908 https://www.cve.org/CVERecord?id=CVE-2022-46908 Référence CVE CVE-2022-48281 https://www.cve.org/CVERecord?id=CVE-2022-48281 Référence CVE CVE-2022-48303 https://www.cve.org/CVERecord?id=CVE-2022-48303 Référence CVE CVE-2022-48522 https://www.cve.org/CVERecord?id=CVE-2022-48522 Référence CVE CVE-2022-48554 https://www.cve.org/CVERecord?id=CVE-2022-48554 Référence CVE CVE-2022-48703 https://www.cve.org/CVERecord?id=CVE-2022-48703 Référence CVE CVE-2022-4899 https://www.cve.org/CVERecord?id=CVE-2022-4899 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-0215 https://www.cve.org/CVERecord?id=CVE-2023-0215 Référence CVE CVE-2023-0216 https://www.cve.org/CVERecord?id=CVE-2023-0216 Référence CVE CVE-2023-0217 https://www.cve.org/CVERecord?id=CVE-2023-0217 Référence CVE CVE-2023-0286 https://www.cve.org/CVERecord?id=CVE-2023-0286 Référence CVE CVE-2023-0361 https://www.cve.org/CVERecord?id=CVE-2023-0361 Référence CVE CVE-2023-0401 https://www.cve.org/CVERecord?id=CVE-2023-0401 Référence CVE CVE-2023-0464 https://www.cve.org/CVERecord?id=CVE-2023-0464 Référence CVE CVE-2023-0465 https://www.cve.org/CVERecord?id=CVE-2023-0465 R

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0756Multiples vulnérabilités dans les produits VMware

ERecord?id=CVE-2022-42012 Référence CVE CVE-2022-4415 https://www.cve.org/CVERecord?id=CVE-2022-4415 Référence CVE CVE-2022-4450 https://www.cve.org/CVERecord?id=CVE-2022-4450 Référence CVE CVE-2022-44638 https://www.cve.org/CVERecord?id=CVE-2022-44638 Référence CVE CVE-2022-46908 https://www.cve.org/CVERecord?id=CVE-2022-46908 Référence CVE CVE-2022-48303 https://www.cve.org/CVERecord?id=CVE-2022-48303 Référence CVE CVE-2022-48522 https://www.cve.org/CVERecord?id=CVE-2022-48522 Référence CVE CVE-2022-48893 https://www.cve.org/CVERecord?id=CVE-2022-48893 Référence CVE CVE-2022-4899 https://www.cve.org/CVERecord?id=CVE-2022-4899 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2022-49063 https://www.cve.org/CVERecord?id=CVE-2022-49063 Référence CVE CVE-2022-49168 https://www.cve.org/CVERecord?id=CVE-2022-49168 Référence CVE CVE-2022-49535 https://www.cve.org/CVERecord?id=CVE-2022-49535 Référence CVE CVE-2022-49636 https://www.cve.org/CVERecord?id=CVE-2022-49636 Référence CVE CVE-2022-49728 https://www.cve.org/CVERecord?id=CVE-2022-49728 Référence CVE CVE-2023-0215 https://www.cve.org/CVERecord?id=CVE-2023-0215 Référence CVE CVE-2023-0216 https://www.cve.org/CVERecord?id=CVE-2023-0216 Référence CVE CVE-2023-0217 https://www.cve.org/CVERecord?id=CVE-2

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0693Multiples vulnérabilités dans VMware Tanzu

ERecord?id=CVE-2022-38533 Référence CVE CVE-2022-4141 https://www.cve.org/CVERecord?id=CVE-2022-4141 Référence CVE CVE-2022-4292 https://www.cve.org/CVERecord?id=CVE-2022-4292 Référence CVE CVE-2022-4293 https://www.cve.org/CVERecord?id=CVE-2022-4293 Référence CVE CVE-2022-44840 https://www.cve.org/CVERecord?id=CVE-2022-44840 Référence CVE CVE-2022-47007 https://www.cve.org/CVERecord?id=CVE-2022-47007 Référence CVE CVE-2022-47008 https://www.cve.org/CVERecord?id=CVE-2022-47008 Référence CVE CVE-2022-47010 https://www.cve.org/CVERecord?id=CVE-2022-47010 Référence CVE CVE-2022-47011 https://www.cve.org/CVERecord?id=CVE-2022-47011 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-0049 https://www.cve.org/CVERecord?id=CVE-2023-0049 Référence CVE CVE-2023-0051 https://www.cve.org/CVERecord?id=CVE-2023-0051 Référence CVE CVE-2023-0054 https://www.cve.org/CVERecord?id=CVE-2023-0054 Référence CVE CVE-2023-0288 https://www.cve.org/CVERecord?id=CVE-2023-0288 Référence CVE CVE-2023-0433 https://www.cve.org/CVERecord?id=CVE-2023-0433 Référence CVE CVE-2023-0512 https://www.cve.org/CVERecord?id=CVE-2023-0512 Référence CVE CVE-2023-1127 https://www.cve.org/CVERecord?id=CVE-2023-1127 Référence CVE CVE-2023-1170 https://www.cve.org/CVERecord?id=CVE-2023-1170 R

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0524Multiples vulnérabilités dans VMware Tanzu

d?id=CVE-2022-41715 Référence CVE CVE-2022-41717 https://www.cve.org/CVERecord?id=CVE-2022-41717 Référence CVE CVE-2022-41723 https://www.cve.org/CVERecord?id=CVE-2022-41723 Référence CVE CVE-2022-41724 https://www.cve.org/CVERecord?id=CVE-2022-41724 Référence CVE CVE-2022-41725 https://www.cve.org/CVERecord?id=CVE-2022-41725 Référence CVE CVE-2022-41862 https://www.cve.org/CVERecord?id=CVE-2022-41862 Référence CVE CVE-2022-42967 https://www.cve.org/CVERecord?id=CVE-2022-42967 Référence CVE CVE-2022-47655 https://www.cve.org/CVERecord?id=CVE-2022-47655 Référence CVE CVE-2022-48468 https://www.cve.org/CVERecord?id=CVE-2022-48468 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-0464 https://www.cve.org/CVERecord?id=CVE-2023-0464 Référence CVE CVE-2023-0465 https://www.cve.org/CVERecord?id=CVE-2023-0465 Référence CVE CVE-2023-0466 https://www.cve.org/CVERecord?id=CVE-2023-0466 Référence CVE CVE-2023-0996 https://www.cve.org/CVERecord?id=CVE-2023-0996 Référence CVE CVE-2023-1255 https://www.cve.org/CVERecord?id=CVE-2023-1255 Référence CVE CVE-2023-24531 https://www.cve.org/CVERecord?id=CVE-2023-24531 Référence CVE CVE-2023-24532 https://www.cve.org/CVERecord?id=CVE-2023-24532 Référence CVE CVE-2023-24534 https://www.cve.org/CVERecord?id=CVE-2023-2

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0481Multiples vulnérabilités dans les produits IBM

/support/pages/node/7235432 Référence CVE CVE-2017-9047 https://www.cve.org/CVERecord?id=CVE-2017-9047 Référence CVE CVE-2018-5711 https://www.cve.org/CVERecord?id=CVE-2018-5711 Référence CVE CVE-2019-11038 https://www.cve.org/CVERecord?id=CVE-2019-11038 Référence CVE CVE-2020-15250 https://www.cve.org/CVERecord?id=CVE-2020-15250 Référence CVE CVE-2020-35538 https://www.cve.org/CVERecord?id=CVE-2020-35538 Référence CVE CVE-2021-38593 https://www.cve.org/CVERecord?id=CVE-2021-38593 Référence CVE CVE-2022-1354 https://www.cve.org/CVERecord?id=CVE-2022-1354 Référence CVE CVE-2022-3570 https://www.cve.org/CVERecord?id=CVE-2022-3570 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-1916 https://www.cve.org/CVERecord?id=CVE-2023-1916 Référence CVE CVE-2023-24056 https://www.cve.org/CVERecord?id=CVE-2023-24056 Référence CVE CVE-2023-24607 https://www.cve.org/CVERecord?id=CVE-2023-24607 Référence CVE CVE-2023-37920 https://www.cve.org/CVERecord?id=CVE-2023-37920 Référence CVE CVE-2023-43804 https://www.cve.org/CVERecord?id=CVE-2023-43804 Référence CVE CVE-2023-52355 https://www.cve.org/CVERecord?id=CVE-2023-52355 Référence CVE CVE-2024-0793 https://www.cve.org/CVERecord?id=CVE-2024-0793 Référence CVE CVE-2024-11831 https://www.cve.org/CVERecord?id=CVE-

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0422Multiples vulnérabilités dans IBM QRadar SIEM

/pages/node/7233394 Référence CVE CVE-2019-12900 https://www.cve.org/CVERecord?id=CVE-2019-12900 Référence CVE CVE-2020-11023 https://www.cve.org/CVERecord?id=CVE-2020-11023 Référence CVE CVE-2020-13955 https://www.cve.org/CVERecord?id=CVE-2020-13955 Référence CVE CVE-2022-34169 https://www.cve.org/CVERecord?id=CVE-2022-34169 Référence CVE CVE-2022-39135 https://www.cve.org/CVERecord?id=CVE-2022-39135 Référence CVE CVE-2022-41678 https://www.cve.org/CVERecord?id=CVE-2022-41678 Référence CVE CVE-2022-42003 https://www.cve.org/CVERecord?id=CVE-2022-42003 Référence CVE CVE-2022-42004 https://www.cve.org/CVERecord?id=CVE-2022-42004 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-0286 https://www.cve.org/CVERecord?id=CVE-2023-0286 Référence CVE CVE-2023-35116 https://www.cve.org/CVERecord?id=CVE-2023-35116 Référence CVE CVE-2023-50291 https://www.cve.org/CVERecord?id=CVE-2023-50291 Référence CVE CVE-2023-50292 https://www.cve.org/CVERecord?id=CVE-2023-50292 Référence CVE CVE-2023-50298 https://www.cve.org/CVERecord?id=CVE-2023-50298 Référence CVE CVE-2023-50386 https://www.cve.org/CVERecord?id=CVE-2023-50386 Référence CVE CVE-2023-50782 https://www.cve.org/CVERecord?id=CVE-2023-50782 Référence CVE CVE-2023-5752 https://www.cve.org/CVERecord?id=CVE

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0401Multiples vulnérabilités dans Juniper Networks Secure Analytics

tics-in-7-5-0-UP11-IF03 Référence CVE CVE-2016-2193 https://www.cve.org/CVERecord?id=CVE-2016-2193 Référence CVE CVE-2017-9047 https://www.cve.org/CVERecord?id=CVE-2017-9047 Référence CVE CVE-2018-12699 https://www.cve.org/CVERecord?id=CVE-2018-12699 Référence CVE CVE-2019-12900 https://www.cve.org/CVERecord?id=CVE-2019-12900 Référence CVE CVE-2020-11023 https://www.cve.org/CVERecord?id=CVE-2020-11023 Référence CVE CVE-2020-21469 https://www.cve.org/CVERecord?id=CVE-2020-21469 Référence CVE CVE-2021-37533 https://www.cve.org/CVERecord?id=CVE-2021-37533 Référence CVE CVE-2022-48773 https://www.cve.org/CVERecord?id=CVE-2022-48773 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-2454 https://www.cve.org/CVERecord?id=CVE-2023-2454 Référence CVE CVE-2023-2455 https://www.cve.org/CVERecord?id=CVE-2023-2455 Référence CVE CVE-2023-37920 https://www.cve.org/CVERecord?id=CVE-2023-37920 Référence CVE CVE-2023-52492 https://www.cve.org/CVERecord?id=CVE-2023-52492 Référence CVE CVE-2023-52922 https://www.cve.org/CVERecord?id=CVE-2023-52922 Référence CVE CVE-2023-5868 https://www.cve.org/CVERecord?id=CVE-2023-5868 Référence CVE CVE-2023-5869 https://www.cve.org/CVERecord?id=CVE-2023-5869 Référence CVE CVE-2023-5870 https://www.cve.org/CVERecord?id=CVE-2023-

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0370Multiples vulnérabilités dans les produits IBM

ve.org/CVERecord?id=CVE-2016-5388 Référence CVE CVE-2016-6796 https://www.cve.org/CVERecord?id=CVE-2016-6796 Référence CVE CVE-2016-6797 https://www.cve.org/CVERecord?id=CVE-2016-6797 Référence CVE CVE-2016-6816 https://www.cve.org/CVERecord?id=CVE-2016-6816 Référence CVE CVE-2016-8735 https://www.cve.org/CVERecord?id=CVE-2016-8735 Référence CVE CVE-2017-5647 https://www.cve.org/CVERecord?id=CVE-2017-5647 Référence CVE CVE-2017-9047 https://www.cve.org/CVERecord?id=CVE-2017-9047 Référence CVE CVE-2020-11023 https://www.cve.org/CVERecord?id=CVE-2020-11023 Référence CVE CVE-2020-8022 https://www.cve.org/CVERecord?id=CVE-2020-8022 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-52922 https://www.cve.org/CVERecord?id=CVE-2023-52922 Référence CVE CVE-2024-11218 https://www.cve.org/CVERecord?id=CVE-2024-11218 Référence CVE CVE-2024-40695 https://www.cve.org/CVERecord?id=CVE-2024-40695 Référence CVE CVE-2024-50302 https://www.cve.org/CVERecord?id=CVE-2024-50302 Référence CVE CVE-2024-51466 https://www.cve.org/CVERecord?id=CVE-2024-51466 Référence CVE CVE-2024-53197 https://www.cve.org/CVERecord?id=CVE-2024-53197 Référence CVE CVE-2024-56171 https://www.cve.org/CVERecord?id=CVE-2024-56171 Référence CVE CVE-2024-57807 https://www.cve.org/CVERecord?id=

Official advisory
CERT-FR · French · CERTFR-2025-AVI-0214Multiples vulnérabilités dans les produits IBM

ord?id=CVE-2022-38900 Référence CVE CVE-2022-41854 https://www.cve.org/CVERecord?id=CVE-2022-41854 Référence CVE CVE-2022-45061 https://www.cve.org/CVERecord?id=CVE-2022-45061 Référence CVE CVE-2022-46175 https://www.cve.org/CVERecord?id=CVE-2022-46175 Référence CVE CVE-2022-4742 https://www.cve.org/CVERecord?id=CVE-2022-4742 Référence CVE CVE-2022-48560 https://www.cve.org/CVERecord?id=CVE-2022-48560 Référence CVE CVE-2022-48564 https://www.cve.org/CVERecord?id=CVE-2022-48564 Référence CVE CVE-2022-48565 https://www.cve.org/CVERecord?id=CVE-2022-48565 Référence CVE CVE-2022-48566 https://www.cve.org/CVERecord?id=CVE-2022-48566 Référence CVE CVE-2022-49043 https://www.cve.org/CVERecord?id=CVE-2022-49043 Référence CVE CVE-2023-24329 https://www.cve.org/CVERecord?id=CVE-2023-24329 Référence CVE CVE-2023-27043 https://www.cve.org/CVERecord?id=CVE-2023-27043 Référence CVE CVE-2023-2976 https://www.cve.org/CVERecord?id=CVE-2023-2976 Référence CVE CVE-2023-32573 https://www.cve.org/CVERecord?id=CVE-2023-32573 Référence CVE CVE-2023-32762 https://www.cve.org/CVERecord?id=CVE-2023-32762 Référence CVE CVE-2023-32763 https://www.cve.org/CVERecord?id=CVE-2023-32763 Référence CVE CVE-2023-36632 https://www.cve.org/CVERecord?id=CVE-2023-36632 Référence CVE CVE-2023-40217 https://www.cve.org/CVERecord?id=CV

Official advisory
03

Patch and workaround

Operational remediation based on structured source evidence.

Status
?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Patch available
Affected
libxml2 as a component of Red Hat Enterprise Linux 6; libxml2-devel as a component of Red Hat Enterprise Linux 6; libxml2-python as a component of Red Hat Enterprise Linux 6; libxml2-static as a component of Red Hat Enterprise Linux 6; libxml2.src as a component of Red Hat Enterprise Linux 6; libxml2 as a component of Red Hat Enterprise Linux 7; libxml2-devel as a component of Red Hat Enterprise Linux 7; libxml2-python as a component of Red Hat Enterprise Linux 7; libxml2-static as a component of Red Hat Enterprise Linux 7; libxml2.src as a component of Red Hat Enterprise Linux 7; libxml2.src as a component of Red Hat JBoss Core Services; openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4
Fixed
rhcos@sha256:a3142fabc649a19b1d189bbd37a3545c3c3c1f24972381ea729b6956f64c3985_x86_64 as a component of Red Hat OpenShift Container Platform 4.12; rhcos@sha256:d0c6c2b7e435e33e345476c3710295e8427c0f28ffa2fe780d01b2f8d0571f22_x86_64 as a component of Red Hat OpenShift Container Platform 4.13; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_aarch64 as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_s390x as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_x86_64 as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_aarch64 as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_s390x as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_x86_64 as a component of Red Hat OpenShift Container Platform 4.15; openshift4/driver-toolkit-rhel9@sha256:860ce0a83db151e3b13f8c01b568074bbaa85eb0de52cf50daedf822d377b269_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:a9d19540219faa65f48a4e94177e6fd8da3c358e6e2ac05be96619c580193dd9_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:b295b56aa74cdc389411ef6ded30ff786795692fdcb75aebe7bdeeaff0dcfab1_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:d65c47bfe03dcb3567d8063fd7fc0c94caf176d517163e54a3c988a6ea5ad10b_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:261465289dc4d63a530f77027dd35bf504dc2652174be990c92eee8987b939d0_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:46459c77907193a033e9da0126ece251b587fdfe021ebea5b04e3634d9b879c6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:7d6dbb421a4af40f2ff22f3835fa62f186723459c5d72b53dc79873388bad802_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:a7fd3d4836c4839b3229bcf91b51070e5f7f75535f92aff9088043299719c418_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:081900c035d3b229b7addc2cfe371144eced313162d7c6b6c6bcd644f1023f36_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:7c83d4bf0a7bd4a501268c9587fcbc0fbcab005821dec3dd16d665c4fd980840_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:7f22893f2dc997fbf488c1d3149de6c405c5e9b12c80f0e443132ea016a3adf3_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:964c654492fb56da61e38f0e3cbbd4f57adbf0db93e204de42556ddcfd3d3e7e_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:2a9db51050d91e01c42d97066c453c6d092c63a80774e2f7b5e3a843e1f437e7_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:7b4386e6a2988a618dce651a0ff4054e3c42f1f4d26b6a3fce2e432f0f80f875_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:b47452eb4d6c7c4ac659ee8c1f40e5af24569d3533d8e445b187348d6db44b58_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:fb29de1b8e2c8cb210758886c40cc788190c6fb1e94daea6dd7a7c4d01ac1d25_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:057838eb4463cf16b2fa968074fe0e9edd062bd68d144bfb6ee768f1cc5c67ef_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:2d2af14b1c1e75bf65bd8b8740a3a13328fb2cc9268bb39d52e220d86175dc5c_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:6072f07967b310d115cadbfbd9c67d9afe60b57cef3618726ad74a1b0bfcbd79_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:de5e93288c8ae6cfc17191d4e1c8f815d129594e5264e3a7684db48bb7ea29d6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; and 1022 more
Action
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is: (For x86_64 architecture) The image digest is sha256:07dfb0210dbe48ec222a9ffcad4bcf1e5b7e5e32140f911e753fe90dcfd4cd12 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
Workaround
No verified workaround is recorded. Limit untrusted access and use least privilege until authoritative guidance is available.
04

Evidence and provenance

Published 26 Jan 2025 · Last source change 3 Nov 2025, 20:35 UTC · CWE-416 · Use After Free

CVE recordCVE.org · 5.2
CVSS sourceCNA
EPSS source
?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.
FIRST · tracked since 2026-08-14
European sourceENISA EUVD · EUVD-2022-53920
Product sourceVendor CSAF · Red Hat Product Security
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceCNA
NVD statusNVD modified after enrichment

Core structured fields are present and their contributing authorities are shown above.

Material change intelligence

What changed after publication

View recent updates →
  1. Affected versionsThe structured affected or fixed version information changed.
    Before
    libxml2 as a component of Red Hat Enterprise Linux 6; libxml2-devel as a component of Red Hat Enterprise Linux 6; libxml2-python as a component of Red Hat Enterprise Linux 6; libxml2-static as a component of Red Hat Enterprise Linux 6; libxml2.src as a component of Red Hat Enterprise Linux 6; libxml2 as a component of Red Hat Enterprise Linux 7; libxml2-devel as a component of Red Hat Enterprise Linux 7; libxml2-python as a component of Red Hat Enterprise Linux 7; libxml2-static as a component of Red Hat Enterprise Linux 7; libxml2.src as a component of Red Hat Enterprise Linux 7; libxml2.src as a component of Red Hat JBoss Core Services · Fixed: rhcos@sha256:a3142fabc649a19b1d189bbd37a3545c3c3c1f24972381ea729b6956f64c3985_x86_64 as a component of Red Hat OpenShift Container Platform 4.12; rhcos@sha256:d0c6c2b7e435e33e345476c3710295e8427c0f28ffa2fe780d01b2f8d0571f22_x86_64 as a component of Red Hat OpenShift Container Platform 4.13; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_aarch64 as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_s390x as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_x86_64 as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_aarch64 as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_s390x as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_x86_64 as a component of Red Hat OpenShift Container Platform 4.15; openshift4/driver-toolkit-rhel9@sha256:860ce0a83db151e3b13f8c01b568074bbaa85eb0de52cf50daedf822d377b269_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:a9d19540219faa65f48a4e94177e6fd8da3c358e6e2ac05be96619c580193dd9_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:b295b56aa74cdc389411ef6ded30ff786795692fdcb75aebe7bdeeaff0dcfab1_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:d65c47bfe03dcb3567d8063fd7fc0c94caf176d517163e54a3c988a6ea5ad10b_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:261465289dc4d63a530f77027dd35bf504dc2652174be990c92eee8987b939d0_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:46459c77907193a033e9da0126ece251b587fdfe021ebea5b04e3634d9b879c6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:7d6dbb421a4af40f2ff22f3835fa62f186723459c5d72b53dc79873388bad802_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:a7fd3d4836c4839b3229bcf91b51070e5f7f75535f92aff9088043299719c418_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:081900c035d3b229b7addc2cfe371144eced313162d7c6b6c6bcd644f1023f36_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:7c83d4bf0a7bd4a501268c9587fcbc0fbcab005821dec3dd16d665c4fd980840_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:7f22893f2dc997fbf488c1d3149de6c405c5e9b12c80f0e443132ea016a3adf3_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:964c654492fb56da61e38f0e3cbbd4f57adbf0db93e204de42556ddcfd3d3e7e_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:2a9db51050d91e01c42d97066c453c6d092c63a80774e2f7b5e3a843e1f437e7_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:7b4386e6a2988a618dce651a0ff4054e3c42f1f4d26b6a3fce2e432f0f80f875_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:b47452eb4d6c7c4ac659ee8c1f40e5af24569d3533d8e445b187348d6db44b58_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:fb29de1b8e2c8cb210758886c40cc788190c6fb1e94daea6dd7a7c4d01ac1d25_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:057838eb4463cf16b2fa968074fe0e9edd062bd68d144bfb6ee768f1cc5c67ef_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:2d2af14b1c1e75bf65bd8b8740a3a13328fb2cc9268bb39d52e220d86175dc5c_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:6072f07967b310d115cadbfbd9c67d9afe60b57cef3618726ad74a1b0bfcbd79_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:de5e93288c8ae6cfc17191d4e1c8f815d129594e5264e3a7684db48bb7ea29d6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; and 1022 more
    After
    libxml2 as a component of Red Hat Enterprise Linux 6; libxml2-devel as a component of Red Hat Enterprise Linux 6; libxml2-python as a component of Red Hat Enterprise Linux 6; libxml2-static as a component of Red Hat Enterprise Linux 6; libxml2.src as a component of Red Hat Enterprise Linux 6; libxml2 as a component of Red Hat Enterprise Linux 7; libxml2-devel as a component of Red Hat Enterprise Linux 7; libxml2-python as a component of Red Hat Enterprise Linux 7; libxml2-static as a component of Red Hat Enterprise Linux 7; libxml2.src as a component of Red Hat Enterprise Linux 7; libxml2.src as a component of Red Hat JBoss Core Services; openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · Fixed: rhcos@sha256:a3142fabc649a19b1d189bbd37a3545c3c3c1f24972381ea729b6956f64c3985_x86_64 as a component of Red Hat OpenShift Container Platform 4.12; rhcos@sha256:d0c6c2b7e435e33e345476c3710295e8427c0f28ffa2fe780d01b2f8d0571f22_x86_64 as a component of Red Hat OpenShift Container Platform 4.13; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_aarch64 as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_ppc64le as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_s390x as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:db73a7d6ba4521de5530078741f9d5b2c18a1fc00a46b249a87d3956ecc065c0_x86_64 as a component of Red Hat OpenShift Container Platform 4.14; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_aarch64 as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_ppc64le as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_s390x as a component of Red Hat OpenShift Container Platform 4.15; rhcos@sha256:51021730ec1c0b0dcaf35474d44541e60ab465539529c219c5665c6ad567394c_x86_64 as a component of Red Hat OpenShift Container Platform 4.15; openshift4/driver-toolkit-rhel9@sha256:860ce0a83db151e3b13f8c01b568074bbaa85eb0de52cf50daedf822d377b269_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:a9d19540219faa65f48a4e94177e6fd8da3c358e6e2ac05be96619c580193dd9_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:b295b56aa74cdc389411ef6ded30ff786795692fdcb75aebe7bdeeaff0dcfab1_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/driver-toolkit-rhel9@sha256:d65c47bfe03dcb3567d8063fd7fc0c94caf176d517163e54a3c988a6ea5ad10b_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:261465289dc4d63a530f77027dd35bf504dc2652174be990c92eee8987b939d0_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:46459c77907193a033e9da0126ece251b587fdfe021ebea5b04e3634d9b879c6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:7d6dbb421a4af40f2ff22f3835fa62f186723459c5d72b53dc79873388bad802_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/network-tools-rhel9@sha256:a7fd3d4836c4839b3229bcf91b51070e5f7f75535f92aff9088043299719c418_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:081900c035d3b229b7addc2cfe371144eced313162d7c6b6c6bcd644f1023f36_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:7c83d4bf0a7bd4a501268c9587fcbc0fbcab005821dec3dd16d665c4fd980840_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:7f22893f2dc997fbf488c1d3149de6c405c5e9b12c80f0e443132ea016a3adf3_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/openshift-route-controller-manager-rhel9@sha256:964c654492fb56da61e38f0e3cbbd4f57adbf0db93e204de42556ddcfd3d3e7e_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:2a9db51050d91e01c42d97066c453c6d092c63a80774e2f7b5e3a843e1f437e7_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:7b4386e6a2988a618dce651a0ff4054e3c42f1f4d26b6a3fce2e432f0f80f875_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:b47452eb4d6c7c4ac659ee8c1f40e5af24569d3533d8e445b187348d6db44b58_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-api-server-rhel9@sha256:fb29de1b8e2c8cb210758886c40cc788190c6fb1e94daea6dd7a7c4d01ac1d25_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:057838eb4463cf16b2fa968074fe0e9edd062bd68d144bfb6ee768f1cc5c67ef_amd64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:2d2af14b1c1e75bf65bd8b8740a3a13328fb2cc9268bb39d52e220d86175dc5c_s390x as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:6072f07967b310d115cadbfbd9c67d9afe60b57cef3618726ad74a1b0bfcbd79_arm64 as a component of Red Hat OpenShift Container Platform 4.16; openshift4/ose-agent-installer-csr-approver-rhel9@sha256:de5e93288c8ae6cfc17191d4e1c8f815d129594e5264e3a7684db48bb7ea29d6_ppc64le as a component of Red Hat OpenShift Container Platform 4.16; and 1022 more
    Red Hat Product Security ↗
Material fields only · duplicate refreshes suppressed · history retained for the configured operational retention period
CVE published
Fixed release or patch reference recorded
ENISA EUVD · EUVD-2022-53920↗Vendor CSAF · Red Hat Product Security↗CVE authority or vendor reference↗Official CVE record (CNA and ADP data)↗NVD record↗
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
Free version - for non-commercial use only.CVE-2022-49043 · cve.blacktree.nl