4.3
Medium
CVE-2024-3508 A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs
Description
A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON. To perform this verification, the uploaded file must first be decompressed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Trusted Profile Analyzer | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2274109 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Trusted Profile Analyzer
The 37 CVEs of Red Hat Trusted Profile Analyzer →
CVE-2026-42784
Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion
7.4
High
CVE-2026-12143
form-data is a library for creating readable multipart/form-data streams
8.7
High
CVE-2026-44486
Axios is a promise based HTTP client for the browser and Node.js
7.5
High
CVE-2026-44487
Axios is a promise based HTTP client for the browser and Node.js
8.2
High