CVE-2025-5914

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5914", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2025-06-09T08:10:18.779Z", "datePublished": "2025-06-09T19:53:48.923Z", "dateUpdated": "2026-11-06T01:00:28.112Z"}, "containers": {"cna": {"title": "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "3.8.0", "versionType": "semver"}], "packageName": "libarchive", "collectionURL": "https://github.com/libarchive/libarchive/", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.7.7-4.el10_0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:10.0"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.1.2-14.el7_9.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_els:7"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-6.el8_10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.2-8.el8_2.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_aus:8.2::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-1.el8_4.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-1.el8_4.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-6.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-6.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-6.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-5.el8_8.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.3.3-5.el8_8.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.5.3-6.el9_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.5.3-6.el9_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.5.3-2.el9_0.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/o:redhat:rhel_e4s:9.0::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.5.3-5.el9_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/o:redhat:rhel_e4s:9.2::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "affected", "versions": [{"version": "0:3.5.3-4.el9_4.1", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/a:redhat:rhel_eus:9.4::crb", "cpe:/o:redhat:rhel_eus:9.4::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "414.92.202510211419-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.14::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "415.92.202601271320-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.15::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "416.94.202601071926-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.16::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "417.94.202510112152-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.17::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "418.94.202510230424-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.18::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "4.19.9.6.202510140714-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.19::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-9", "defaultStatus": "affected", "versions": [{"version": "4.20.9.6.202509251656-0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift:4.20::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "web-terminal/web-terminal-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1.11-19", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "web-terminal/web-terminal-tooling-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.11-8", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Web Terminal 1.12 on RHEL 9", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "web-terminal/web-terminal-tooling-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.12-4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:webterminal:1.12::el9"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-data-index-ephemeral-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-data-index-postgresql-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-db-migrator-tool-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-jobs-service-postgresql-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-management-console-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-9", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "1.36.0-12", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "1.36.0-18", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-swf-builder-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-11", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-serverless-1/logic-swf-devmode-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.36.0-7", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"]}, {"vendor": "Red Hat", "product": "cert-manager operator for Red Hat OpenShift 1.16", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "cert-manager/jetstack-cert-manager-rhel9", "defaultStatus": "affected", "versions": [{"version": "v1.16.5-1760515757", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:cert_manager:1.16::el9"]}, {"vendor": "Red Hat", "product": "OpenShift Compliance Operator 1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "compliance/openshift-compliance-must-gather-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.8.0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"]}, {"vendor": "Red Hat", "product": "OpenShift Compliance Operator 1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "compliance/openshift-compliance-openscap-rhel8", "defaultStatus": "affected", "versions": [{"version": "1.8.0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"]}, {"vendor": "Red Hat", "product": "OpenShift Compliance Operator 1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "compliance/openshift-compliance-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "1.8.0", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"]}, {"vendor": "Red Hat", "product": "OpenShift File Integrity Operator - FIO 1", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "compliance/openshift-file-integrity-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "v1.3", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Discovery 2", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "discovery/discovery-server-rhel9", "defaultStatus": "affected", "versions": [{"version": "2.2.1-1758555934", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:discovery:2::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "insights-proxy/insights-proxy-container-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.5.6-1756187445", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-agent-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116455", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-all-in-one-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116482", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-collector-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116441", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-es-index-cleaner-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116449", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-es-rollover-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116439", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-ingester-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116447", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-operator-bundle", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756128595", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-query-rhel8", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756125872", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhosdt/jaeger-rhel8-operator", "defaultStatus": "affected", "versions": [{"version": "rhosdt-3.5-1756116445", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757422110", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757421846", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757421804", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-must-gather-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757422070", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-podvm-builder-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757421879", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757422401", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "openshift-sandboxed-containers/osc-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1.10.2-1757421890", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "libarchive", "defaultStatus": "unknown", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "openshift/ose-rhel-coreos-8", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift:4"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:14130", "name": "RHSA-2025:14130", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14135", "name": "RHSA-2025:14135", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14137", "name": "RHSA-2025:14137", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14141", "name": "RHSA-2025:14141", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14142", "name": "RHSA-2025:14142", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14525", "name": "RHSA-2025:14525", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14528", "name": "RHSA-2025:14528", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14594", "name": "RHSA-2025:14594", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14644", "name": "RHSA-2025:14644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14808", "name": "RHSA-2025:14808", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14810", "name": "RHSA-2025:14810", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14828", "name": "RHSA-2025:14828", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15024", "name": "RHSA-2025:15024", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15397", "name": "RHSA-2025:15397", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15709", "name": "RHSA-2025:15709", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15827", "name": "RHSA-2025:15827", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15828", "name": "RHSA-2025:15828", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:16524", "name": "RHSA-2025:16524", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18217", "name": "RHSA-2025:18217", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18218", "name": "RHSA-2025:18218", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18219", "name": "RHSA-2025:18219", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19041", "name": "RHSA-2025:19041", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19046", "name": "RHSA-2025:19046", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:21885", "name": "RHSA-2025:21885", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:21913", "name": "RHSA-2025:21913", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0326", "name": "RHSA-2026:0326", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0934", "name": "RHSA-2026:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:1541", "name": "RHSA-2026:1541", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-5914", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861", "name": "RHBZ#2370861", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/libarchive/libarchive/pull/2598"}, {"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"}], "datePublic": "2025-05-20T00:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound", "timeline": [{"lang": "en", "time": "2025-06-06T17:58:25.491Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-05-20T00:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T01:00:28.112Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"references": [{"url": "https://github.com/libarchive/libarchive/pull/2598", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-10T15:14:35.773233Z", "id": "CVE-2025-5914", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-10T15:30:42.589Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:39:07.960Z"}, "affected": [{"vendor": "Siemens", "product": "SIDIS Secured SmartPlug", "versions": [{"status": "affected", "version": "0", "lessThan": "V7.26.0310", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIDIS Secured SmartPlug", "versions": [{"status": "affected", "version": "0", "lessThan": "V7.26.0310", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:39:07.960Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5914", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-10T15:14:35.773233Z"}}}], "references": [{"url": "https://github.com/libarchive/libarchive/pull/2598", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-10T14:23:42.747Z"}}], "cna": {"title": "Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "3.8.0", "versionType": "semver"}], "packageName": "libarchive", "collectionURL": "https://github.com/libarchive/libarchive/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:3.7.7-4.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "versions": [{"status": "unaffected", "version": "0:3.1.2-14.el7_9.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:3.3.3-6.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_aus:8.2::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "versions": [{"status": "unaffected", "version": "0:3.3.2-8.el8_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:3.3.3-1.el8_4.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "versions": [{"status": "unaffected", "version": "0:3.3.3-1.el8_4.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "versions": [{"status": "unaffected", "version": "0:3.3.3-6.el8_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:3.3.3-6.el8_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.3.3-6.el8_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "versions": [{"status": "unaffected", "version": "0:3.3.3-5.el8_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.3.3-5.el8_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.5.3-6.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:3.5.3-6.el9_6", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/o:redhat:rhel_e4s:9.0::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.5.3-2.el9_0.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/o:redhat:rhel_e4s:9.2::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "versions": [{"status": "unaffected", "version": "0:3.5.3-5.el9_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/a:redhat:rhel_eus:9.4::crb", "cpe:/o:redhat:rhel_eus:9.4::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "versions": [{"status": "unaffected", "version": "0:3.5.3-4.el9_4.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.14", "versions": [{"status": "unaffected", "version": "414.92.202510211419-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.15", "versions": [{"status": "unaffected", "version": "415.92.202601271320-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.16", "versions": [{"status": "unaffected", "version": "416.94.202601071926-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.17", "versions": [{"status": "unaffected", "version": "417.94.202510112152-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.18", "versions": [{"status": "unaffected", "version": "418.94.202510230424-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.19", "versions": [{"status": "unaffected", "version": "4.19.9.6.202510140714-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4.20", "versions": [{"status": "unaffected", "version": "4.20.9.6.202509251656-0", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "versions": [{"status": "unaffected", "version": "1.11-19", "lessThan": "*", "versionType": "rpm"}], "packageName": "web-terminal/web-terminal-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "vendor": "Red Hat", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "versions": [{"status": "unaffected", "version": "1.11-8", "lessThan": "*", "versionType": "rpm"}], "packageName": "web-terminal/web-terminal-tooling-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:webterminal:1.12::el9"], "vendor": "Red Hat", "product": "Red Hat Web Terminal 1.12 on RHEL 9", "versions": [{"status": "unaffected", "version": "1.12-4", "lessThan": "*", "versionType": "rpm"}], "packageName": "web-terminal/web-terminal-tooling-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-data-index-ephemeral-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-data-index-postgresql-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-db-migrator-tool-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-10", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-jobs-service-postgresql-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-4", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-management-console-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-12", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-18", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-11", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-swf-builder-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "vendor": "Red Hat", "product": "RHOSS-1.36-RHEL-8", "versions": [{"status": "unaffected", "version": "1.36.0-7", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-serverless-1/logic-swf-devmode-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cert_manager:1.16::el9"], "vendor": "Red Hat", "product": "cert-manager operator for Red Hat OpenShift 1.16", "versions": [{"status": "unaffected", "version": "v1.16.5-1760515757", "lessThan": "*", "versionType": "rpm"}], "packageName": "cert-manager/jetstack-cert-manager-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"], "vendor": "Red Hat", "product": "OpenShift Compliance Operator 1", "versions": [{"status": "unaffected", "version": "1.8.0", "lessThan": "*", "versionType": "rpm"}], "packageName": "compliance/openshift-compliance-must-gather-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"], "vendor": "Red Hat", "product": "OpenShift Compliance Operator 1", "versions": [{"status": "unaffected", "version": "1.8.0", "lessThan": "*", "versionType": "rpm"}], "packageName": "compliance/openshift-compliance-openscap-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"], "vendor": "Red Hat", "product": "OpenShift Compliance Operator 1", "versions": [{"status": "unaffected", "version": "1.8.0", "lessThan": "*", "versionType": "rpm"}], "packageName": "compliance/openshift-compliance-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1::el9"], "vendor": "Red Hat", "product": "OpenShift File Integrity Operator - FIO 1", "versions": [{"status": "unaffected", "version": "v1.3", "lessThan": "*", "versionType": "rpm"}], "packageName": "compliance/openshift-file-integrity-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:discovery:2::el9"], "vendor": "Red Hat", "product": "Red Hat Discovery 2", "versions": [{"status": "unaffected", "version": "2.2.1-1758555934", "lessThan": "*", "versionType": "rpm"}], "packageName": "discovery/discovery-server-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "vendor": "Red Hat", "product": "Red Hat Insights proxy 1.5", "versions": [{"status": "unaffected", "version": "1.5.6-1756187445", "lessThan": "*", "versionType": "rpm"}], "packageName": "insights-proxy/insights-proxy-container-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116455", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-agent-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116482", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-all-in-one-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116441", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-collector-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116449", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-es-index-cleaner-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116439", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-es-rollover-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116447", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-ingester-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756128595", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-operator-bundle", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756125872", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-query-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift distributed tracing 3.5.3", "versions": [{"status": "unaffected", "version": "rhosdt-3.5-1756116445", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhosdt/jaeger-rhel8-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757422110", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757421846", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757421804", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757422070", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-must-gather-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757421879", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-podvm-builder-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757422401", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift sandboxed containers 1.10", "versions": [{"status": "unaffected", "version": "1.10.2-1757421890", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-sandboxed-containers/osc-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:rhel_els:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "libarchive", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-06T17:58:25.491Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-05-20T00:00:00.000Z", "value": "Made public."}], "datePublic": "2025-05-20T00:00:00.000Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2025:14130", "name": "RHSA-2025:14130", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14135", "name": "RHSA-2025:14135", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14137", "name": "RHSA-2025:14137", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14141", "name": "RHSA-2025:14141", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14142", "name": "RHSA-2025:14142", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14525", "name": "RHSA-2025:14525", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14528", "name": "RHSA-2025:14528", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14594", "name": "RHSA-2025:14594", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14644", "name": "RHSA-2025:14644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14808", "name": "RHSA-2025:14808", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14810", "name": "RHSA-2025:14810", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:14828", "name": "RHSA-2025:14828", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15024", "name": "RHSA-2025:15024", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15397", "name": "RHSA-2025:15397", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15709", "name": "RHSA-2025:15709", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15827", "name": "RHSA-2025:15827", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:15828", "name": "RHSA-2025:15828", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:16524", "name": "RHSA-2025:16524", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18217", "name": "RHSA-2025:18217", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18218", "name": "RHSA-2025:18218", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:18219", "name": "RHSA-2025:18219", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19041", "name": "RHSA-2025:19041", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:19046", "name": "RHSA-2025:19046", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:21885", "name": "RHSA-2025:21885", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2025:21913", "name": "RHSA-2025:21913", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0326", "name": "RHSA-2026:0326", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:0934", "name": "RHSA-2026:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:1541", "name": "RHSA-2026:1541", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2025-5914", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861", "name": "RHBZ#2370861", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/libarchive/libarchive/pull/2598"}, {"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T01:00:28.112Z"}, "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"}}, "cveMetadata": {"cveId": "CVE-2025-5914", "state": "PUBLISHED", "dateUpdated": "2026-11-06T01:00:28.112Z", "dateReserved": "2025-06-09T08:10:18.779Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2025-06-09T19:53:48.923Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/libarchive/libarchive/", "defaultStatus": "unaffected", "packageName": "libarchive", "versions": [{"lessThan": "3.8.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.0"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.7.7-4.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:7"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.1.2-14.el7_9.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8::crb", "cpe:/o:redhat:enterprise_linux:8::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-6.el8_10", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_aus:8.2::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.2-8.el8_2.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-1.el8_4.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_aus:8.4::baseos", "cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-1.el8_4.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-6.el8_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-6.el8_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_aus:8.6::baseos", "cpe:/o:redhat:rhel_e4s:8.6::baseos", "cpe:/o:redhat:rhel_tus:8.6::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-6.el8_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-5.el8_8.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_e4s:8.8::baseos", "cpe:/o:redhat:rhel_tus:8.8::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.3.3-5.el8_8.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.5.3-6.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/o:redhat:enterprise_linux:9::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.5.3-6.el9_6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0::appstream", "cpe:/o:redhat:rhel_e4s:9.0::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.5.3-2.el9_0.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2::appstream", "cpe:/o:redhat:rhel_e4s:9.2::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.5.3-5.el9_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4::appstream", "cpe:/a:redhat:rhel_eus:9.4::crb", "cpe:/o:redhat:rhel_eus:9.4::baseos"], "defaultStatus": "affected", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:3.5.3-4.el9_4.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.14::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.14", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "414.92.202510211419-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.15::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.15", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "415.92.202601271320-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.16::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "416.94.202601071926-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.17::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.17", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "417.94.202510112152-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.18::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "418.94.202510230424-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.19::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.19", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.19.9.6.202510140714-0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4.20::el9"], "defaultStatus": "affected", "packageName": "openshift/ose-rhel-coreos-9", "product": "Red Hat OpenShift Container Platform 4.20", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.20.9.6.202509251656-0", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "defaultStatus": "affected", "packageName": "web-terminal/web-terminal-rhel9-operator", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.11-19", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:webterminal:1.11::el9"], "defaultStatus": "affected", "packageName": "web-terminal/web-terminal-tooling-rhel9", "product": "Red Hat Web Terminal 1.11 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.11-8", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:webterminal:1.12::el9"], "defaultStatus": "affected", "packageName": "web-terminal/web-terminal-tooling-rhel9", "product": "Red Hat Web Terminal 1.12 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.12-4", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-data-index-ephemeral-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-data-index-postgresql-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-db-migrator-tool-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-jobs-service-ephemeral-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-10", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-jobs-service-postgresql-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-10", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-kn-workflow-cli-artifacts-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-4", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-management-console-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-9", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-operator-bundle", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-12", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-rhel8-operator", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-18", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-swf-builder-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-11", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_serverless:1.36::el8"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/logic-swf-devmode-rhel8", "product": "RHOSS-1.36-RHEL-8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.36.0-7", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cert_manager:1.16::el9"], "defaultStatus": "affected", "packageName": "cert-manager/jetstack-cert-manager-rhel9", "product": "cert-manager operator for Red Hat OpenShift 1.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "v1.16.5-1760515757", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"], "defaultStatus": "affected", "packageName": "compliance/openshift-compliance-must-gather-rhel8", "product": "OpenShift Compliance Operator 1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.8.0", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"], "defaultStatus": "affected", "packageName": "compliance/openshift-compliance-openscap-rhel8", "product": "OpenShift Compliance Operator 1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.8.0", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_compliance_operator:1::el9"], "defaultStatus": "affected", "packageName": "compliance/openshift-compliance-rhel8-operator", "product": "OpenShift Compliance Operator 1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.8.0", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_file_integrity_operator:1::el9"], "defaultStatus": "affected", "packageName": "compliance/openshift-file-integrity-rhel8-operator", "product": "OpenShift File Integrity Operator - FIO 1", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "v1.3", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:discovery:2::el9"], "defaultStatus": "affected", "packageName": "discovery/discovery-server-rhel9", "product": "Red Hat Discovery 2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "2.2.1-1758555934", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:insights_proxy:1.5::el9"], "defaultStatus": "affected", "packageName": "insights-proxy/insights-proxy-container-rhel9", "product": "Red Hat Insights proxy 1.5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.5.6-1756187445", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-agent-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116455", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-all-in-one-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116482", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-collector-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116441", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-es-index-cleaner-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116449", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-es-rollover-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116439", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-ingester-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116447", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-operator-bundle", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756128595", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-query-rhel8", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756125872", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_distributed_tracing:3.5::el8"], "defaultStatus": "affected", "packageName": "rhosdt/jaeger-rhel8-operator", "product": "Red Hat OpenShift distributed tracing 3.5.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "rhosdt-3.5-1756116445", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757422110", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-cloud-api-adaptor-webhook-rhel9", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757421846", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757421804", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-must-gather-rhel9", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757422070", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-podvm-builder-rhel9", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757421879", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757422401", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:confidential_compute_attestation:1.10::el9"], "defaultStatus": "affected", "packageName": "openshift-sandboxed-containers/osc-rhel9-operator", "product": "Red Hat OpenShift sandboxed containers 1.10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1.10.2-1757421890", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unknown", "packageName": "libarchive", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift:4"], "defaultStatus": "unaffected", "packageName": "openshift/ose-rhel-coreos-8", "product": "Red Hat OpenShift Container Platform 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIDIS Secured SmartPlug", "vendor": "Siemens", "versions": [{"lessThan": "V7.26.0310", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*", "matchCriteriaId": "FCC41392-D22A-4BE5-B7E7-DE5D6BA40052", "versionEndExcluding": "3.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "932D137F-528B-4526-9A89-CD59FA1AB0FE", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "142AD0DD-4CF3-4D74-9442-459CE3347E3A", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "D65C2163-CFC2-4ABB-8F4E-CB09CEBD006C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en la librer\u00eda libarchive, espec\u00edficamente en la funci\u00f3n archive_read_format_rar_seek_data(). Esta falla implica un desbordamiento de enteros que puede provocar una condici\u00f3n de doble liberaci\u00f3n. Explotar una vulnerabilidad de doble liberaci\u00f3n puede provocar corrupci\u00f3n de memoria, lo que permite a un atacante ejecutar c\u00f3digo arbitrario o causar una denegaci\u00f3n de servicio."}], "id": "CVE-2025-5914", "lastModified": "2026-11-06T01:17:45.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5914", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-10T15:14:35.773233Z", "version": "2.0.3"}}]}, "published": "2025-06-09T20:15:26.123", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14130"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14135"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14137"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14141"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14142"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14525"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14528"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14594"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14644"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14808"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14810"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:14828"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:15024"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:15397"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:15709"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:15827"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:15828"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:16524"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:18217"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:18218"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:18219"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:19041"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:19046"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:21885"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2025:21913"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2026:0326"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:0934"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:1541"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2025-5914"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/libarchive/libarchive/pull/2598"}, {"source": "secalert@redhat.com", "tags": ["Release Notes"], "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-585531.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking", "Patch"], "url": "https://github.com/libarchive/libarchive/pull/2598"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c", "id": "2370861", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370861"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.9", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-190->CWE-415", "details": ["A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition.", "A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption, enabling an attacker to execute arbitrary code or cause a denial-of-service condition."], "mitigation": {"lang": "en:us", "value": "Upgrade to libarchive version 3.8.0 or later, which includes important security fixes and stability improvements."}, "name": "CVE-2025-5914", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "libarchive", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libarchive", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "libarchive", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "libarchive", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "libarchive", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2025-05-20T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-5914\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-5914\nhttps://github.com/libarchive/libarchive/pull/2598\nhttps://github.com/libarchive/libarchive/releases/tag/v3.8.0"], "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-20T16:25:32.605817+00:00", "value": {"mitigation_remediation": ["Ensure all affected Red\u202fHat products have applied the updated libarchive package; confirm the pkg\u2011version is 3.8.0 or newer.", "If an immediate update is not feasible, mitigate by disabling RAR format parsing in any application that uses libarchive, or by sandboxing that component so that a crafted archive cannot reach privileged memory.", "Monitor for any new advisories or exploits related to this flaw, and review application logs for signs of attempted exploitation."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Affected products include many Red\u202fHat distributions and platforms that bundle libarchive. According to the vendor data, this includes the Red\u202fHat Compliance Operator 1, Red\u202fHat File Integrity Operator 1, Red\u202fHat Enterprise Linux releases 6,\u202f7,\u202f8,\u202f9,\u202f10, Red\u202fHat OpenShift Container Platform versions 4.14\u20114.20, Red\u202fHat Web Terminal 1.11 and 1.12, Red\u202fHat Discovery 2, Red\u202fHat Insights Proxy 1.5, Red\u202fHat Cert\u2011Manager operator 1.16, as well as OpenShift distributed tracing 3.5, OpenShift Serverless 1.36, and other related packages. The CVE description does not specify the exact libarchive version affected, but the referenced errata indicate the fix is included in libarchive v3.8.0 and in several Red\u202fHat errata packages.", "description_and_impact": "A flaw in the libarchive library\u2019s archive_read_format_rar_seek_data() function causes an integer overflow that can produce a double\u2011free condition. The double\u2011free can corrupt memory and allow an attacker to execute arbitrary code or crash the process. The vulnerability is identified as CWE\u2011190 and CWE\u2011415 and can turn a crafted RAR archive into a vector for code execution or denial of service.", "risk_and_exploitability": "The CVSS score of 7.8 labels this a high\u2011severity flaw, yet the EPSS score of less than 1\u202f% suggests a low likelihood of exploitation currently. It is not listed in the CISA KEV catalog, so no publicly known active exploitation campaigns are recorded. The most probable attack path requires a component that processes RAR archives via libarchive; by feeding a malicious archive an attacker can trigger the double\u2011free and potentially execute arbitrary code. Because of this potential impact, the vulnerability demands prompt remediation."}}}}, "created": "2026-04-20T16:30:06.291382+00:00", "updated": "2026-04-20T16:30:06.291402+00:00", "vendors": []}