CVE-2023-37466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-37466", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-07-06T13:01:36.997Z", "datePublished": "2023-07-13T23:17:51.434Z", "dateUpdated": "2026-01-05T21:25:27.207Z"}, "containers": {"cna": {"title": "vm2 Sandbox Escape vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"}, {"name": "https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744", "tags": ["x_refsource_MISC"], "url": "https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744"}, {"name": "https://github.com/patriksimek/vm2/releases/tag/v3.10.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/patriksimek/vm2/releases/tag/v3.10.0"}], "affected": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"version": "<= 3.9.19", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-05T21:25:27.207Z"}, "descriptions": [{"lang": "en", "value": "vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-cchq-frgv-rjh5", "discovery": "UNKNOWN"}}, "adp": [{"title": "CVE Program Container", "references": [{"name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"}, {"url": "https://security.netapp.com/advisory/ntap-20241108-0002/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:48:53.572Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T17:36:22.731709Z", "id": "CVE-2023-37466", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T14:51:16.362Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20241108-0002/"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T21:48:53.572Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-37466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T17:36:22.731709Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-21T14:51:12.628Z"}}], "cna": {"title": "vm2 Sandbox Escape vulnerability", "source": {"advisory": "GHSA-cchq-frgv-rjh5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "<= 3.9.19"}]}], "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "name": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744", "name": "https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/patriksimek/vm2/releases/tag/v3.10.0", "name": "https://github.com/patriksimek/vm2/releases/tag/v3.10.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-05T21:25:27.207Z"}}}, "cveMetadata": {"cveId": "CVE-2023-37466", "state": "PUBLISHED", "dateUpdated": "2026-01-05T21:25:27.207Z", "dateReserved": "2023-07-06T13:01:36.997Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-07-13T23:17:51.434Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "vm2", "vendor": "patriksimek", "versions": [{"status": "affected", "version": "<= 3.9.19"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "5F54A6F9-FD6B-4E23-A6B7-616952129C1C", "versionEndIncluding": "3.9.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue."}, {"lang": "es", "value": "vm2 es una m\u00e1quina virtual/sandbox avanzada para Node.js. La librer\u00eda contiene problemas de seguridad cr\u00edticos y no debe usarse para producci\u00f3n. El mantenimiento del proyecto ha sido descontinuado. En vm2 para versiones hasta 3.9.19, la sanitizaci\u00f3n del controlador `Promise` se puede omitir con la propiedad de acceso `@@species`, lo que permite a los atacantes escapar del entorno limitado y ejecutar c\u00f3digo arbitrario, lo que potencialmente permite la ejecuci\u00f3n remota de c\u00f3digo dentro del contexto del entorno limitado de vm2."}], "id": "CVE-2023-37466", "lastModified": "2026-06-17T06:08:16.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-37466", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-15T17:36:22.731709Z", "version": "2.0.3"}}]}, "published": "2023-07-14T00:15:09.263", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744"}, {"source": "security-advisories@github.com", "url": "https://github.com/patriksimek/vm2/releases/tag/v3.10.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20241108-0002/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-agent-service-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-apiserver-network-proxy-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-assisted-image-service-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-assisted-installer-agent-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-assisted-installer-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-assisted-installer-reporter-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-aws-encryption-provider-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-api-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-api-provider-agent-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-api-provider-aws-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-api-provider-azure-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-api-provider-kubevirt-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-clusterclaims-controller-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-curator-controller-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-clusterlifecycle-state-metrics-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-proxy-addon-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-cluster-proxy-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-console-mce-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-discovery-operator-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-hive-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-hypershift-addon-operator-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-hypershift-deployment-controller-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-hypershift-operator-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-klusterlet-operator-bundle-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-managedcluster-import-controller-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-managed-serviceaccount-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-multicloud-manager-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-must-gather-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-operator-bundle-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-operator-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-placement-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-provider-credential-controller-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-registration-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-registration-operator-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4972", "cpe": "cpe:/a:redhat:multicluster_engine:2.1::el8", "package": "multicluster-engine-work-container", "product_name": "Multicluster Engine for Kubernetes", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4862", "cpe": "cpe:/a:redhat:multicluster_engine:2.3::el8", "package": "multicluster-engine/console-mce-rhel8:v2.3.1-7", "product_name": "multicluster engine for Kubernetes 2.3 for RHEL 8", "release_date": "2023-08-29T00:00:00Z"}, {"advisory": "RHSA-2023:4862", "cpe": "cpe:/a:redhat:multicluster_engine:2.3::el8", "package": "multicluster-engine/multicluster-engine-console-mce-rhel8:v2.3.1-7", "product_name": "multicluster engine for Kubernetes 2.3 for RHEL 8", "release_date": "2023-08-29T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-governance-policy-addon-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-grafana-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-must-gather-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-operator-bundle-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-prometheus-config-reloader-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-prometheus-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-volsync-addon-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "cert-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "cluster-backup-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "config-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "console-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "endpoint-monitoring-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-propagator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-spec-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-status-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-template-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "grafana-dashboard-loader-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "iam-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "insights-client-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "insights-metrics-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "klusterlet-addon-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "kube-rbac-proxy-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "kube-state-metrics-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "management-ingress-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "memcached-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "memcached-exporter-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "metrics-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicloud-integrations-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multiclusterhub-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multiclusterhub-repo-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-observability-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-operators-application-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-operators-channel-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-operators-subscription-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "node-exporter-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "observatorium-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "observatorium-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "prometheus-alertmanager-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "prometheus-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "rbac-query-proxy-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "redisgraph-tls-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-aggregator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "submariner-addon-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "thanos-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4980", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "thanos-receive-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2023-09-05T00:00:00Z"}, {"advisory": "RHSA-2023:4654", "cpe": "cpe:/a:redhat:acm:2.7::el8", "package": "rhacm2/console-rhel8:v2.7.7-4", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2.7 for RHEL 8", "release_date": "2023-08-15T00:00:00Z"}, {"advisory": "RHSA-2023:4875", "cpe": "cpe:/a:redhat:acm:2.8::el8", "package": "rhacm2/console-rhel8:v2.8.1-7", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2.8 for RHEL 8", "release_date": "2023-08-30T00:00:00Z"}], "bugzilla": {"description": "vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code", "id": "2232376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2232376"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-78", "details": ["vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.", "A flaw was found in the vm2 Promise handler sanitization, which allows attackers to escape the sandbox. This flaw allows attackers to run arbitrary code."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2023-37466", "public_date": "2023-07-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-37466\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-37466\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5"], "threat_severity": "Moderate"}

{}