Vulnerabilites related to redhat - jboss_fuse
cve-2020-14340
Vulnerability from cvelistv5
Published
2021-06-02 12:04
Modified
2024-08-04 12:39
Severity ?
Summary
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1860218x_refsource_MISC
https://www.oracle.com/security-alerts/cpujan2022.htmlx_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.htmlx_refsource_MISC
Impacted products
Vendor Product Version
n/a XNIO Version: xnio 3.7.9.Final, xnio 3.8.2.Final, xnio 3.9.0.Final
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:39:36.533Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1860218",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "XNIO",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "xnio 3.7.9.Final, xnio 3.8.2.Final, xnio 3.9.0.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-04-19T23:21:36",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1860218",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-14340",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "XNIO",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "xnio 3.7.9.Final, xnio 3.8.2.Final, xnio 3.9.0.Final",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1860218",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1860218",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2022.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-14340",
      datePublished: "2021-06-02T12:04:28",
      dateReserved: "2020-06-17T00:00:00",
      dateUpdated: "2024-08-04T12:39:36.533Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-2589
Vulnerability from cvelistv5
Published
2018-07-26 15:00
Modified
2024-08-05 14:02
Severity ?
8.7 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Summary
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
References
https://access.redhat.com/errata/RHSA-2017:1832vendor-advisory, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat hawtio Version: 1.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T14:02:06.497Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2017:1832",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:1832",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "hawtio",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "1.4",
                  },
               ],
            },
         ],
         datePublic: "2017-07-28T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.7,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-285",
                     description: "CWE-285",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-07-27T09:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2017:1832",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:1832",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2017-2589",
      datePublished: "2018-07-26T15:00:00",
      dateReserved: "2016-12-01T00:00:00",
      dateUpdated: "2024-08-05T14:02:06.497Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-10718
Vulnerability from cvelistv5
Published
2020-09-16 18:06
Modified
2024-08-04 11:14
Severity ?
Summary
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1828476x_refsource_MISC
Impacted products
Vendor Product Version
n/a Wildfly Version: before wildfly-embedded-13.0.0.Final
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T11:14:14.762Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1828476",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Wildfly",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "before wildfly-embedded-13.0.0.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Exposed Dangerous Method or Function",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-09-16T18:06:26",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1828476",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-10718",
      datePublished: "2020-09-16T18:06:26",
      dateReserved: "2020-03-20T00:00:00",
      dateUpdated: "2024-08-04T11:14:14.762Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2024-7885
Vulnerability from cvelistv5
Published
2024-08-21 14:13
Modified
2025-03-03 14:18
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
References
https://access.redhat.com/errata/RHSA-2024:11023vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6508vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:6883vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:7441vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:7442vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:7735vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:7736vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-7885vdb-entry, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2305290issue-tracking, x_refsource_REDHAT
Impacted products
Vendor Product Version
Version: 0   < 2.2.36.Final
Version: 2.3.0.Alpha1   < 2.3.17.Final
 Create a notification for this product.
   Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4     cpe:/a:redhat:rhboac_hawtio:4.0.0
 Create a notification for this product.
   Red Hat Red Hat build of Apache Camel 3.20.7 for Spring Boot     cpe:/a:redhat:apache_camel_spring_boot:3.20.7
 Create a notification for this product.
   Red Hat Red Hat build of Apache Camel 4.4.2 for Spring Boot     cpe:/a:redhat:apache_camel_spring_boot:4.4.2
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7     cpe:/a:redhat:jboss_enterprise_application_platform:7.4
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Unaffected: 0:2.2.33-2.SP2_redhat_00001.1.el8eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8 Unaffected: 0:7.4.18-1.GA_redhat_00003.1.el8eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Unaffected: 0:2.2.33-2.SP2_redhat_00001.1.el9eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9 Unaffected: 0:7.4.18-1.GA_redhat_00003.1.el9eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Unaffected: 0:2.2.33-2.SP2_redhat_00001.1.el7eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7 Unaffected: 0:7.4.18-1.GA_redhat_00003.1.el7eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8.0
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Unaffected: 0:1.11.9-2.redhat_00001.1.el8eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Unaffected: 0:800.3.1-2.GA_redhat_00002.1.el8eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Unaffected: 0:2.3.14-2.SP2_redhat_00001.1.el8eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 Unaffected: 0:8.0.3-13.GA_redhat_00007.1.el8eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Unaffected: 0:1.11.9-2.redhat_00001.1.el9eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Unaffected: 0:800.3.1-2.GA_redhat_00002.1.el9eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Unaffected: 0:2.3.14-2.SP2_redhat_00001.1.el9eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 Unaffected: 0:8.0.3-13.GA_redhat_00007.1.el9eap   < *
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8
    cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9
 Create a notification for this product.
   Red Hat Red Hat build of Apache Camel for Spring Boot 3     cpe:/a:redhat:camel_spring_boot:3
 Create a notification for this product.
   Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
 Create a notification for this product.
   Red Hat Red Hat build of Quarkus     cpe:/a:redhat:quarkus:3
 Create a notification for this product.
   Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
 Create a notification for this product.
   Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
 Create a notification for this product.
   Red Hat Red Hat Integration Camel K 1     cpe:/a:redhat:integration:1
 Create a notification for this product.
   Red Hat Red Hat JBoss Data Grid 7     cpe:/a:redhat:jboss_data_grid:7
 Create a notification for this product.
   Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
 Create a notification for this product.
   Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
 Create a notification for this product.
   Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-7885",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-08-21T15:21:22.416004Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-08-21T15:21:42.735Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-10-11T22:03:18.905Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "https://security.netapp.com/advisory/ntap-20241011-0004/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://github.com/undertow-io/undertow",
               defaultStatus: "unaffected",
               packageName: "undertow",
               versions: [
                  {
                     lessThan: "2.2.36.Final",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
                  {
                     lessThan: "2.3.17.Final",
                     status: "affected",
                     version: "2.3.0.Alpha1",
                     versionType: "custom",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:rhboac_hawtio:4.0.0",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "HawtIO 4.0.0 for Red Hat build of Apache Camel 4",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:apache_camel_spring_boot:3.20.7",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat build of Apache Camel 3.20.7 for Spring Boot",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:apache_camel_spring_boot:4.4.2",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat build of Apache Camel 4.4.2 for Spring Boot",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4",
               ],
               defaultStatus: "unaffected",
               product: "Red Hat JBoss Enterprise Application Platform 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.2.33-2.SP2_redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-wildfly",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:7.4.18-1.GA_redhat_00003.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.2.33-2.SP2_redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-wildfly",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:7.4.18-1.GA_redhat_00003.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.2.33-2.SP2_redhat_00001.1.el7eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7",
               ],
               defaultStatus: "affected",
               packageName: "eap7-wildfly",
               product: "Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:7.4.18-1.GA_redhat_00003.1.el7eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat JBoss Enterprise Application Platform 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-amazon-ion-java",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.9-2.redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-eap-product-conf-parent",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:800.3.1-2.GA_redhat_00002.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.3.14-2.SP2_redhat_00001.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-wildfly",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:8.0.3-13.GA_redhat_00007.1.el8eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-amazon-ion-java",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:1.11.9-2.redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-eap-product-conf-parent",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:800.3.1-2.GA_redhat_00002.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-undertow",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:2.3.14-2.SP2_redhat_00001.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8",
                  "cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9",
               ],
               defaultStatus: "affected",
               packageName: "eap8-wildfly",
               product: "Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9",
               vendor: "Red Hat",
               versions: [
                  {
                     lessThan: "*",
                     status: "unaffected",
                     version: "0:8.0.3-13.GA_redhat_00007.1.el9eap",
                     versionType: "rpm",
                  },
               ],
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:camel_spring_boot:3",
               ],
               defaultStatus: "affected",
               packageName: "undertow",
               product: "Red Hat build of Apache Camel for Spring Boot 3",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:build_keycloak:",
               ],
               defaultStatus: "affected",
               packageName: "undertow",
               product: "Red Hat Build of Keycloak",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:quarkus:3",
               ],
               defaultStatus: "unaffected",
               packageName: "io.quarkus/quarkus-undertow",
               product: "Red Hat build of Quarkus",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:8",
               ],
               defaultStatus: "affected",
               packageName: "undertow",
               product: "Red Hat Data Grid 8",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_fuse:7",
               ],
               defaultStatus: "affected",
               packageName: "undertow",
               product: "Red Hat Fuse 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:integration:1",
               ],
               defaultStatus: "affected",
               packageName: "undertow",
               product: "Red Hat Integration Camel K 1",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jboss_data_grid:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat JBoss Data Grid 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
               cpes: [
                  "cpe:/a:redhat:jbosseapxp",
               ],
               defaultStatus: "unaffected",
               packageName: "undertow",
               product: "Red Hat JBoss Enterprise Application Platform Expansion Pack",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:jboss_enterprise_bpms_platform:7",
               ],
               defaultStatus: "unknown",
               packageName: "undertow",
               product: "Red Hat Process Automation 7",
               vendor: "Red Hat",
            },
            {
               collectionURL: "https://access.redhat.com/downloads/content/package-browser/",
               cpes: [
                  "cpe:/a:redhat:red_hat_single_sign_on:7",
               ],
               defaultStatus: "affected",
               packageName: "undertow",
               product: "Red Hat Single Sign-On 7",
               vendor: "Red Hat",
            },
         ],
         credits: [
            {
               lang: "en",
               value: "Red Hat would like to thank BfC for reporting this issue.",
            },
         ],
         datePublic: "2024-08-07T00:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     namespace: "https://access.redhat.com/security/updates/classification/",
                     value: "Important",
                  },
                  type: "Red Hat severity rating",
               },
            },
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
               format: "CVSS",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-362",
                     description: "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-03T14:18:10.445Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2024:11023",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:11023",
            },
            {
               name: "RHSA-2024:6508",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:6508",
            },
            {
               name: "RHSA-2024:6883",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:6883",
            },
            {
               name: "RHSA-2024:7441",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:7441",
            },
            {
               name: "RHSA-2024:7442",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:7442",
            },
            {
               name: "RHSA-2024:7735",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:7735",
            },
            {
               name: "RHSA-2024:7736",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2024:7736",
            },
            {
               tags: [
                  "vdb-entry",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/security/cve/CVE-2024-7885",
            },
            {
               name: "RHBZ#2305290",
               tags: [
                  "issue-tracking",
                  "x_refsource_REDHAT",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2305290",
            },
         ],
         timeline: [
            {
               lang: "en",
               time: "2024-08-16T09:00:41.686000+00:00",
               value: "Reported to Red Hat.",
            },
            {
               lang: "en",
               time: "2024-08-07T00:00:00+00:00",
               value: "Made public.",
            },
         ],
         title: "Undertow: improper state management in proxy protocol parsing causes information leakage",
         x_redhatCweChain: "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')",
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2024-7885",
      datePublished: "2024-08-21T14:13:36.579Z",
      dateReserved: "2024-08-16T15:35:47.357Z",
      dateUpdated: "2025-03-03T14:18:10.445Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-3642
Vulnerability from cvelistv5
Published
2021-08-05 20:48
Modified
2024-08-03 17:01
Severity ?
Summary
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1981407x_refsource_MISC
Impacted products
Vendor Product Version
n/a wildfly-elytron Version: Wildfly Elytron 1.10.14.Final, Wildfly Elytron 1.15.5.Final, Wildfly Elytron 1.16.1.Final
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T17:01:07.598Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1981407",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly-elytron",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Wildfly Elytron 1.10.14.Final, Wildfly Elytron 1.15.5.Final, Wildfly Elytron 1.16.1.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-203",
                     description: "CWE-203",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-08-30T17:37:38",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1981407",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2021-3642",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "wildfly-elytron",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Wildfly Elytron 1.10.14.Final, Wildfly Elytron 1.15.5.Final, Wildfly Elytron 1.16.1.Final",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-203",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1981407",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1981407",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2021-3642",
      datePublished: "2021-08-05T20:48:01",
      dateReserved: "2021-07-12T00:00:00",
      dateUpdated: "2024-08-03T17:01:07.598Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2013-7398
Vulnerability from cvelistv5
Published
2015-06-24 16:00
Modified
2024-08-06 18:09
Severity ?
Summary
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
References
http://www.securityfocus.com/bid/69317vdb-entry, x_refsource_BID
http://rhn.redhat.com/errata/RHSA-2015-0850.htmlvendor-advisory, x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-1176.htmlvendor-advisory, x_refsource_REDHAT
https://github.com/AsyncHttpClient/async-http-client/issues/197x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-0851.htmlvendor-advisory, x_refsource_REDHAT
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20x_refsource_CONFIRM
http://openwall.com/lists/oss-security/2014/08/26/1mailing-list, x_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2015-1551.htmlvendor-advisory, x_refsource_REDHAT
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Emailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T18:09:16.513Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "69317",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/69317",
               },
               {
                  name: "RHSA-2015:0850",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
               },
               {
                  name: "RHSA-2015:1176",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/AsyncHttpClient/async-http-client/issues/197",
               },
               {
                  name: "RHSA-2015:0851",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
               },
               {
                  name: "[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://openwall.com/lists/oss-security/2014/08/26/1",
               },
               {
                  name: "RHSA-2015:1551",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
               },
               {
                  name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
               },
               {
                  name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2013-01-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-16T05:06:36",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "69317",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/69317",
            },
            {
               name: "RHSA-2015:0850",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
            },
            {
               name: "RHSA-2015:1176",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/AsyncHttpClient/async-http-client/issues/197",
            },
            {
               name: "RHSA-2015:0851",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
            },
            {
               name: "[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://openwall.com/lists/oss-security/2014/08/26/1",
            },
            {
               name: "RHSA-2015:1551",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
            },
            {
               name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
            },
            {
               name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2013-7398",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "69317",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/69317",
                  },
                  {
                     name: "RHSA-2015:0850",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
                  },
                  {
                     name: "RHSA-2015:1176",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
                  },
                  {
                     name: "https://github.com/AsyncHttpClient/async-http-client/issues/197",
                     refsource: "CONFIRM",
                     url: "https://github.com/AsyncHttpClient/async-http-client/issues/197",
                  },
                  {
                     name: "RHSA-2015:0851",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
                  },
                  {
                     name: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
                     refsource: "CONFIRM",
                     url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
                  },
                  {
                     name: "[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client",
                     refsource: "MLIST",
                     url: "http://openwall.com/lists/oss-security/2014/08/26/1",
                  },
                  {
                     name: "RHSA-2015:1551",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
                  },
                  {
                     name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E",
                  },
                  {
                     name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2013-7398",
      datePublished: "2015-06-24T16:00:00",
      dateReserved: "2014-08-25T00:00:00",
      dateUpdated: "2024-08-06T18:09:16.513Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2023-44487
Vulnerability from cvelistv5
Published
2023-10-10 00:00
Modified
2025-03-07 18:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
References
https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
https://news.ycombinator.com/item?id=37831062
https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
https://github.com/envoyproxy/envoy/pull/30055
https://github.com/haproxy/haproxy/issues/2312
https://github.com/eclipse/jetty.project/issues/10679
https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
https://github.com/nghttp2/nghttp2/pull/1961
https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
https://github.com/alibaba/tengine/issues/1872
https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
https://news.ycombinator.com/item?id=37830987
https://news.ycombinator.com/item?id=37830998
https://github.com/caddyserver/caddy/issues/5877
https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
https://github.com/bcdannyboy/CVE-2023-44487
https://github.com/grpc/grpc-go/pull/6703
https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
https://my.f5.com/manage/s/article/K000137106
https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
https://bugzilla.proxmox.com/show_bug.cgi?id=4988
https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
http://www.openwall.com/lists/oss-security/2023/10/10/7mailing-list
http://www.openwall.com/lists/oss-security/2023/10/10/6mailing-list
https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
https://github.com/microsoft/CBL-Mariner/pull/6381
https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
https://github.com/facebook/proxygen/pull/466
https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
https://github.com/micrictor/http2-rst-stream
https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
https://github.com/h2o/h2o/pull/3291
https://github.com/nodejs/node/pull/50121
https://github.com/dotnet/announcements/issues/277
https://github.com/golang/go/issues/63417
https://github.com/advisories/GHSA-vx74-f528-fxqg
https://github.com/apache/trafficserver/pull/10564
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
https://www.openwall.com/lists/oss-security/2023/10/10/6
https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
https://github.com/opensearch-project/data-prepper/issues/3474
https://github.com/kubernetes/kubernetes/pull/121120
https://github.com/oqtane/oqtane.framework/discussions/3367
https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
https://netty.io/news/2023/10/10/4-1-100-Final.html
https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
https://news.ycombinator.com/item?id=37837043
https://github.com/kazu-yamamoto/http2/issues/93
https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
https://www.debian.org/security/2023/dsa-5522vendor-advisory
https://www.debian.org/security/2023/dsa-5521vendor-advisory
https://access.redhat.com/security/cve/cve-2023-44487
https://github.com/ninenines/cowboy/issues/1615
https://github.com/varnishcache/varnish-cache/issues/3996
https://github.com/tempesta-tech/tempesta/issues/1986
https://blog.vespa.ai/cve-2023-44487/
https://github.com/etcd-io/etcd/issues/16740
https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
https://istio.io/latest/news/security/istio-security-2023-004/
https://github.com/junkurihara/rust-rpxy/issues/97
https://bugzilla.suse.com/show_bug.cgi?id=1216123
https://bugzilla.redhat.com/show_bug.cgi?id=2242803
https://ubuntu.com/security/CVE-2023-44487
https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
https://github.com/advisories/GHSA-qppj-fm5r-hxr3
https://github.com/apache/httpd-site/pull/10
https://github.com/projectcontour/contour/pull/5826
https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
https://github.com/line/armeria/pull/5232
https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
https://security.paloaltonetworks.com/CVE-2023-44487
https://github.com/akka/akka-http/issues/4323
https://github.com/openresty/openresty/issues/930
https://github.com/apache/apisix/issues/10320
https://github.com/Azure/AKS/issues/3947
https://github.com/Kong/kong/discussions/11741
https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
https://github.com/caddyserver/caddy/releases/tag/v2.7.5
https://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlmailing-list
http://www.openwall.com/lists/oss-security/2023/10/13/4mailing-list
http://www.openwall.com/lists/oss-security/2023/10/13/9mailing-list
https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/vendor-advisory
https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
https://lists.debian.org/debian-lts-announce/2023/10/msg00023.htmlmailing-list
https://security.netapp.com/advisory/ntap-20231016-0001/
https://lists.debian.org/debian-lts-announce/2023/10/msg00024.htmlmailing-list
http://www.openwall.com/lists/oss-security/2023/10/18/4mailing-list
http://www.openwall.com/lists/oss-security/2023/10/18/8mailing-list
http://www.openwall.com/lists/oss-security/2023/10/19/6mailing-list
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/vendor-advisory
http://www.openwall.com/lists/oss-security/2023/10/20/8mailing-list
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/vendor-advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00045.htmlmailing-list
https://www.debian.org/security/2023/dsa-5540vendor-advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00047.htmlmailing-list
https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/vendor-advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00001.htmlmailing-list
https://www.debian.org/security/2023/dsa-5549vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/vendor-advisory
https://www.debian.org/security/2023/dsa-5558vendor-advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg00012.htmlmailing-list
https://security.gentoo.org/glsa/202311-09vendor-advisory
https://www.debian.org/security/2023/dsa-5570vendor-advisory
https://security.netapp.com/advisory/ntap-20240426-0007/
https://security.netapp.com/advisory/ntap-20240621-0006/
https://security.netapp.com/advisory/ntap-20240621-0007/
https://github.com/grpc/grpc/releases/tag/v1.59.2
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "http",
                  vendor: "ietf",
                  versions: [
                     {
                        status: "affected",
                        version: "2.0",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 7.5,
                     baseSeverity: "HIGH",
                     confidentialityImpact: "NONE",
                     integrityImpact: "NONE",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2023-44487",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-23T20:34:21.334116Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2023-10-10",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-44487",
                     },
                     type: "kev",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-400",
                        description: "CWE-400 Uncontrolled Resource Consumption",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-23T20:35:03.253Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-19T07:48:04.546Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=37831062",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/envoyproxy/envoy/pull/30055",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/haproxy/haproxy/issues/2312",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/eclipse/jetty.project/issues/10679",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nghttp2/nghttp2/pull/1961",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/alibaba/tengine/issues/1872",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=37830987",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=37830998",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/caddyserver/caddy/issues/5877",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/bcdannyboy/CVE-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/grpc/grpc-go/pull/6703",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://my.f5.com/manage/s/article/K000137106",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/microsoft/CBL-Mariner/pull/6381",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/facebook/proxygen/pull/466",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/micrictor/http2-rst-stream",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/h2o/h2o/pull/3291",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/nodejs/node/pull/50121",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/dotnet/announcements/issues/277",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/golang/go/issues/63417",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/advisories/GHSA-vx74-f528-fxqg",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/trafficserver/pull/10564",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.openwall.com/lists/oss-security/2023/10/10/6",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/opensearch-project/data-prepper/issues/3474",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kubernetes/kubernetes/pull/121120",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/oqtane/oqtane.framework/discussions/3367",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://netty.io/news/2023/10/10/4-1-100-Final.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://news.ycombinator.com/item?id=37837043",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kazu-yamamoto/http2/issues/93",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
               },
               {
                  name: "DSA-5522",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5522",
               },
               {
                  name: "DSA-5521",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5521",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/cve-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/ninenines/cowboy/issues/1615",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/varnishcache/varnish-cache/issues/3996",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/tempesta-tech/tempesta/issues/1986",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://blog.vespa.ai/cve-2023-44487/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/etcd-io/etcd/issues/16740",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://istio.io/latest/news/security/istio-security-2023-004/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/junkurihara/rust-rpxy/issues/97",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.suse.com/show_bug.cgi?id=1216123",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://ubuntu.com/security/CVE-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/httpd-site/pull/10",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/projectcontour/contour/pull/5826",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/line/armeria/pull/5232",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.paloaltonetworks.com/CVE-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/akka/akka-http/issues/4323",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/openresty/openresty/issues/930",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/apisix/issues/10320",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Azure/AKS/issues/3947",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/Kong/kong/discussions/11741",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
               },
               {
                  name: "[debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
               },
               {
                  name: "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/10/13/4",
               },
               {
                  name: "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/10/13/9",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
               },
               {
                  name: "FEDORA-2023-ed2642fd58",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
               },
               {
                  name: "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20231016-0001/",
               },
               {
                  name: "[debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
               },
               {
                  name: "[oss-security] 20231018 Vulnerability in Jenkins",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/10/18/4",
               },
               {
                  name: "[oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/10/18/8",
               },
               {
                  name: "[oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/10/19/6",
               },
               {
                  name: "FEDORA-2023-54fadada12",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
               },
               {
                  name: "FEDORA-2023-5ff7bf1dd8",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
               },
               {
                  name: "[oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/10/20/8",
               },
               {
                  name: "FEDORA-2023-17efd3f2cd",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
               },
               {
                  name: "FEDORA-2023-d5030c983c",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
               },
               {
                  name: "FEDORA-2023-0259c3f26f",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
               },
               {
                  name: "FEDORA-2023-2a9214af5f",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
               },
               {
                  name: "FEDORA-2023-e9c04d81c1",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
               },
               {
                  name: "FEDORA-2023-f66fc0f62a",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
               },
               {
                  name: "FEDORA-2023-4d2fd884ea",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
               },
               {
                  name: "FEDORA-2023-b2c50535cb",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
               },
               {
                  name: "FEDORA-2023-fe53e13b5b",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
               },
               {
                  name: "FEDORA-2023-4bf641255e",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
               },
               {
                  name: "[debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
               },
               {
                  name: "DSA-5540",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5540",
               },
               {
                  name: "[debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
               },
               {
                  name: "FEDORA-2023-1caffb88af",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
               },
               {
                  name: "FEDORA-2023-3f70b8d406",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
               },
               {
                  name: "FEDORA-2023-7b52921cae",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
               },
               {
                  name: "FEDORA-2023-7934802344",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
               },
               {
                  name: "FEDORA-2023-dbe64661af",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
               },
               {
                  name: "FEDORA-2023-822aab0a5a",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
               },
               {
                  name: "[debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
               },
               {
                  name: "DSA-5549",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5549",
               },
               {
                  name: "FEDORA-2023-c0c6a91330",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
               },
               {
                  name: "FEDORA-2023-492b7be466",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
               },
               {
                  name: "DSA-5558",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5558",
               },
               {
                  name: "[debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
               },
               {
                  name: "GLSA-202311-09",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202311-09",
               },
               {
                  name: "DSA-5570",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2023/dsa-5570",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240426-0007/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240621-0007/",
               },
               {
                  url: "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-07T18:15:13.812Z",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
            },
            {
               url: "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
            },
            {
               url: "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
            },
            {
               url: "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
            },
            {
               url: "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
            },
            {
               url: "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
            },
            {
               url: "https://news.ycombinator.com/item?id=37831062",
            },
            {
               url: "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
            },
            {
               url: "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
            },
            {
               url: "https://github.com/envoyproxy/envoy/pull/30055",
            },
            {
               url: "https://github.com/haproxy/haproxy/issues/2312",
            },
            {
               url: "https://github.com/eclipse/jetty.project/issues/10679",
            },
            {
               url: "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
            },
            {
               url: "https://github.com/nghttp2/nghttp2/pull/1961",
            },
            {
               url: "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
            },
            {
               url: "https://github.com/alibaba/tengine/issues/1872",
            },
            {
               url: "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
            },
            {
               url: "https://news.ycombinator.com/item?id=37830987",
            },
            {
               url: "https://news.ycombinator.com/item?id=37830998",
            },
            {
               url: "https://github.com/caddyserver/caddy/issues/5877",
            },
            {
               url: "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
            },
            {
               url: "https://github.com/bcdannyboy/CVE-2023-44487",
            },
            {
               url: "https://github.com/grpc/grpc-go/pull/6703",
            },
            {
               url: "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
            },
            {
               url: "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
            },
            {
               url: "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
            },
            {
               url: "https://my.f5.com/manage/s/article/K000137106",
            },
            {
               url: "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
            },
            {
               url: "https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
            },
            {
               url: "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
            },
            {
               name: "[oss-security] 20231010 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/10/7",
            },
            {
               name: "[oss-security] 20231010 CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/10/6",
            },
            {
               url: "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
            },
            {
               url: "https://github.com/microsoft/CBL-Mariner/pull/6381",
            },
            {
               url: "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
            },
            {
               url: "https://github.com/facebook/proxygen/pull/466",
            },
            {
               url: "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
            },
            {
               url: "https://github.com/micrictor/http2-rst-stream",
            },
            {
               url: "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
            },
            {
               url: "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
            },
            {
               url: "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
            },
            {
               url: "https://github.com/h2o/h2o/pull/3291",
            },
            {
               url: "https://github.com/nodejs/node/pull/50121",
            },
            {
               url: "https://github.com/dotnet/announcements/issues/277",
            },
            {
               url: "https://github.com/golang/go/issues/63417",
            },
            {
               url: "https://github.com/advisories/GHSA-vx74-f528-fxqg",
            },
            {
               url: "https://github.com/apache/trafficserver/pull/10564",
            },
            {
               url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
            },
            {
               url: "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
            },
            {
               url: "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
            },
            {
               url: "https://www.openwall.com/lists/oss-security/2023/10/10/6",
            },
            {
               url: "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
            },
            {
               url: "https://github.com/opensearch-project/data-prepper/issues/3474",
            },
            {
               url: "https://github.com/kubernetes/kubernetes/pull/121120",
            },
            {
               url: "https://github.com/oqtane/oqtane.framework/discussions/3367",
            },
            {
               url: "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
            },
            {
               url: "https://netty.io/news/2023/10/10/4-1-100-Final.html",
            },
            {
               url: "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
            },
            {
               url: "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
            },
            {
               url: "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
            },
            {
               url: "https://news.ycombinator.com/item?id=37837043",
            },
            {
               url: "https://github.com/kazu-yamamoto/http2/issues/93",
            },
            {
               url: "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
            },
            {
               url: "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
            },
            {
               url: "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
            },
            {
               name: "DSA-5522",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5522",
            },
            {
               name: "DSA-5521",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5521",
            },
            {
               url: "https://access.redhat.com/security/cve/cve-2023-44487",
            },
            {
               url: "https://github.com/ninenines/cowboy/issues/1615",
            },
            {
               url: "https://github.com/varnishcache/varnish-cache/issues/3996",
            },
            {
               url: "https://github.com/tempesta-tech/tempesta/issues/1986",
            },
            {
               url: "https://blog.vespa.ai/cve-2023-44487/",
            },
            {
               url: "https://github.com/etcd-io/etcd/issues/16740",
            },
            {
               url: "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
            },
            {
               url: "https://istio.io/latest/news/security/istio-security-2023-004/",
            },
            {
               url: "https://github.com/junkurihara/rust-rpxy/issues/97",
            },
            {
               url: "https://bugzilla.suse.com/show_bug.cgi?id=1216123",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
            },
            {
               url: "https://ubuntu.com/security/CVE-2023-44487",
            },
            {
               url: "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
            },
            {
               url: "https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
            },
            {
               url: "https://github.com/apache/httpd-site/pull/10",
            },
            {
               url: "https://github.com/projectcontour/contour/pull/5826",
            },
            {
               url: "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
            },
            {
               url: "https://github.com/line/armeria/pull/5232",
            },
            {
               url: "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
            },
            {
               url: "https://security.paloaltonetworks.com/CVE-2023-44487",
            },
            {
               url: "https://github.com/akka/akka-http/issues/4323",
            },
            {
               url: "https://github.com/openresty/openresty/issues/930",
            },
            {
               url: "https://github.com/apache/apisix/issues/10320",
            },
            {
               url: "https://github.com/Azure/AKS/issues/3947",
            },
            {
               url: "https://github.com/Kong/kong/discussions/11741",
            },
            {
               url: "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
            },
            {
               url: "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
            },
            {
               url: "https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
            },
            {
               name: "[debian-lts-announce] 20231013 [SECURITY] [DLA 3617-1] tomcat9 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
            },
            {
               name: "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/13/4",
            },
            {
               name: "[oss-security] 20231013 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/13/9",
            },
            {
               url: "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
            },
            {
               url: "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
            },
            {
               name: "FEDORA-2023-ed2642fd58",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
            },
            {
               url: "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
            },
            {
               name: "[debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20231016-0001/",
            },
            {
               name: "[debian-lts-announce] 20231016 [SECURITY] [DLA 3617-2] tomcat9 regression update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
            },
            {
               name: "[oss-security] 20231018 Vulnerability in Jenkins",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/18/4",
            },
            {
               name: "[oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/18/8",
            },
            {
               name: "[oss-security] 20231019 CVE-2023-45802: Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/19/6",
            },
            {
               name: "FEDORA-2023-54fadada12",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
            },
            {
               name: "FEDORA-2023-5ff7bf1dd8",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
            },
            {
               name: "[oss-security] 20231020 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2023/10/20/8",
            },
            {
               name: "FEDORA-2023-17efd3f2cd",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
            },
            {
               name: "FEDORA-2023-d5030c983c",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
            },
            {
               name: "FEDORA-2023-0259c3f26f",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
            },
            {
               name: "FEDORA-2023-2a9214af5f",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
            },
            {
               name: "FEDORA-2023-e9c04d81c1",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
            },
            {
               name: "FEDORA-2023-f66fc0f62a",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
            },
            {
               name: "FEDORA-2023-4d2fd884ea",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
            },
            {
               name: "FEDORA-2023-b2c50535cb",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
            },
            {
               name: "FEDORA-2023-fe53e13b5b",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
            },
            {
               name: "FEDORA-2023-4bf641255e",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
            },
            {
               name: "[debian-lts-announce] 20231030 [SECURITY] [DLA 3641-1] jetty9 security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
            },
            {
               name: "DSA-5540",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5540",
            },
            {
               name: "[debian-lts-announce] 20231031 [SECURITY] [DLA 3638-1] h2o security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
            },
            {
               url: "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
            },
            {
               name: "FEDORA-2023-1caffb88af",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
            },
            {
               name: "FEDORA-2023-3f70b8d406",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
            },
            {
               name: "FEDORA-2023-7b52921cae",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
            },
            {
               name: "FEDORA-2023-7934802344",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
            },
            {
               name: "FEDORA-2023-dbe64661af",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
            },
            {
               name: "FEDORA-2023-822aab0a5a",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
            },
            {
               name: "[debian-lts-announce] 20231105 [SECURITY] [DLA 3645-1] trafficserver security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
            },
            {
               name: "DSA-5549",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5549",
            },
            {
               name: "FEDORA-2023-c0c6a91330",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
            },
            {
               name: "FEDORA-2023-492b7be466",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
            },
            {
               name: "DSA-5558",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5558",
            },
            {
               name: "[debian-lts-announce] 20231119 [SECURITY] [DLA 3656-1] netty security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
            },
            {
               name: "GLSA-202311-09",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202311-09",
            },
            {
               name: "DSA-5570",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://www.debian.org/security/2023/dsa-5570",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240426-0007/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240621-0007/",
            },
            {
               url: "https://github.com/grpc/grpc/releases/tag/v1.59.2",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2023-44487",
      datePublished: "2023-10-10T00:00:00.000Z",
      dateReserved: "2023-09-29T00:00:00.000Z",
      dateUpdated: "2025-03-07T18:15:13.812Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-25644
Vulnerability from cvelistv5
Published
2020-10-06 00:00
Modified
2024-08-04 15:40
Severity ?
Summary
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
References
https://issues.redhat.com/browse/WFSSL-51
https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files
https://bugzilla.redhat.com/show_bug.cgi?id=1885485
https://security.netapp.com/advisory/ntap-20201016-0004/
Impacted products
Vendor Product Version
n/a wildfly-openssl Version: before wildfly-openssl 1.1.3.Final
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:40:36.576Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://issues.redhat.com/browse/WFSSL-51",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1885485",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201016-0004/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly-openssl",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "before wildfly-openssl 1.1.3.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-401",
                     description: "CWE-401",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-07T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://issues.redhat.com/browse/WFSSL-51",
            },
            {
               url: "https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1885485",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20201016-0004/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-25644",
      datePublished: "2020-10-06T00:00:00",
      dateReserved: "2020-09-16T00:00:00",
      dateUpdated: "2024-08-04T15:40:36.576Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-25689
Vulnerability from cvelistv5
Published
2020-10-30 00:00
Modified
2024-08-04 15:40
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689
https://security.netapp.com/advisory/ntap-20201123-0006/
Impacted products
Vendor Product Version
Red Hat wildfly-core Version: up to 21.0.0.Final
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T15:40:36.775Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201123-0006/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly-core",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "up to 21.0.0.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-401",
                     description: "CWE-401",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-07T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20201123-0006/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-25689",
      datePublished: "2020-10-30T00:00:00",
      dateReserved: "2020-09-16T00:00:00",
      dateUpdated: "2024-08-04T15:40:36.775Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14307
Vulnerability from cvelistv5
Published
2020-07-24 00:00
Modified
2024-08-04 12:39
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307
Impacted products
Vendor Product Version
Red Hat wildfly Version: jboss-ejb-client versions shipped with Red Hat JBoss EAP 7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:39:36.215Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "jboss-ejb-client versions shipped with Red Hat JBoss EAP 7",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-404",
                     description: "CWE-404",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-07T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-14307",
      datePublished: "2020-07-24T00:00:00",
      dateReserved: "2020-06-17T00:00:00",
      dateUpdated: "2024-08-04T12:39:36.215Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2013-4372
Vulnerability from cvelistv5
Published
2013-09-30 19:00
Modified
2024-08-06 16:38
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
References
http://rhn.redhat.com/errata/RHSA-2013-1862.htmlvendor-advisory, x_refsource_REDHAT
http://www.securityfocus.com/bid/62659vdb-entry, x_refsource_BID
http://fusesource.com/issues/browse/FMC-495x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-1286.htmlvendor-advisory, x_refsource_REDHAT
http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1011736x_refsource_CONFIRM
https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T16:38:02.238Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2013:1862",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2013-1862.html",
               },
               {
                  name: "62659",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/62659",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://fusesource.com/issues/browse/FMC-495",
               },
               {
                  name: "RHSA-2013:1286",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2013-1286.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1011736",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2013-08-19T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2016-12-29T18:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2013:1862",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2013-1862.html",
            },
            {
               name: "62659",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/62659",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://fusesource.com/issues/browse/FMC-495",
            },
            {
               name: "RHSA-2013:1286",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2013-1286.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1011736",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2013-4372",
      datePublished: "2013-09-30T19:00:00",
      dateReserved: "2013-06-12T00:00:00",
      dateUpdated: "2024-08-06T16:38:02.238Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-14297
Vulnerability from cvelistv5
Published
2020-07-24 15:37
Modified
2024-10-15 17:14
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat wildfly Version: jboss-ejb-client as shipped with Red Hat JBoss EAP 7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T12:39:36.271Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2020-14297",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-15T17:09:41.879622Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-15T17:14:53.962Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "jboss-ejb-client as shipped with Red Hat JBoss EAP 7",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-07-24T15:37:25",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-14297",
      datePublished: "2020-07-24T15:37:25",
      dateReserved: "2020-06-17T00:00:00",
      dateUpdated: "2024-10-15T17:14:53.962Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14888
Vulnerability from cvelistv5
Published
2020-01-23 16:25
Modified
2024-08-05 00:26
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2020:0729vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20220211-0001/x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat undertow Version: All versions before 2.0.28.SP1
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.131Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888",
               },
               {
                  name: "RHSA-2020:0729",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0729",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220211-0001/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undertow",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "All versions before 2.0.28.SP1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-11T22:06:18",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888",
            },
            {
               name: "RHSA-2020:0729",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0729",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220211-0001/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-14888",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "undertow",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All versions before 2.0.28.SP1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888",
                  },
                  {
                     name: "RHSA-2020:0729",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0729",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220211-0001/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220211-0001/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14888",
      datePublished: "2020-01-23T16:25:11",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.131Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-7559
Vulnerability from cvelistv5
Published
2019-08-01 00:00
Modified
2024-08-06 07:51
Severity ?
2.7 (Low) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Summary
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559
https://issues.apache.org/jira/browse/AMQ-6470
Impacted products
Vendor Product Version
Apache ActiveMQ Version: 5.15.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T07:51:28.509Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://issues.apache.org/jira/browse/AMQ-6470",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "ActiveMQ",
               vendor: "Apache",
               versions: [
                  {
                     status: "affected",
                     version: "5.15.5",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 2.7,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-306",
                     description: "CWE-306",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-30T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559",
            },
            {
               url: "https://issues.apache.org/jira/browse/AMQ-6470",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2015-7559",
      datePublished: "2019-08-01T00:00:00",
      dateReserved: "2015-09-29T00:00:00",
      dateUpdated: "2024-08-06T07:51:28.509Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14820
Vulnerability from cvelistv5
Published
2020-01-08 14:50
Modified
2024-08-05 00:26
Severity ?
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820x_refsource_CONFIRM
Impacted products
Vendor Product Version
keycloak keycloak Version: fixed in 8.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.126Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "keycloak",
               vendor: "keycloak",
               versions: [
                  {
                     status: "affected",
                     version: "fixed in 8.0.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-01-08T14:50:44",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-14820",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "keycloak",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "fixed in 8.0.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "keycloak",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "4.3/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14820",
      datePublished: "2020-01-08T14:50:44",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.126Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-0121
Vulnerability from cvelistv5
Published
2017-12-29 22:00
Modified
2024-08-06 09:05
Severity ?
Summary
The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
References
https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfx_refsource_MISC
https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1ex_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1072716x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T09:05:38.810Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072716",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2014-03-05T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-12-29T21:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072716",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2014-0121",
      datePublished: "2017-12-29T22:00:00",
      dateReserved: "2013-12-03T00:00:00",
      dateUpdated: "2024-08-06T09:05:38.810Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2017-12196
Vulnerability from cvelistv5
Published
2018-04-18 01:00
Modified
2024-08-05 18:28
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Summary
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
References
https://access.redhat.com/errata/RHSA-2018:0479vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0481vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:2405vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:1525vendor-advisory, x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:0480vendor-advisory, x_refsource_REDHAT
https://issues.jboss.org/browse/UNDERTOW-1190x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2018:3768vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2018:0478vendor-advisory, x_refsource_REDHAT
Impacted products
Vendor Product Version
unspecified undertow Version: undertow 1.4.18.SP1
Version: undertow 2.0.2.Final
Version: undertow 1.4.24.Final
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T18:28:16.713Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2018:0479",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0479",
               },
               {
                  name: "RHSA-2018:0481",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0481",
               },
               {
                  name: "RHSA-2018:2405",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2405",
               },
               {
                  name: "RHSA-2018:1525",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:1525",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196",
               },
               {
                  name: "RHSA-2018:0480",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0480",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://issues.jboss.org/browse/UNDERTOW-1190",
               },
               {
                  name: "RHSA-2018:3768",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3768",
               },
               {
                  name: "RHSA-2018:0478",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:0478",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undertow",
               vendor: "unspecified",
               versions: [
                  {
                     status: "affected",
                     version: "undertow 1.4.18.SP1",
                  },
                  {
                     status: "affected",
                     version: " undertow 2.0.2.Final",
                  },
                  {
                     status: "affected",
                     version: " undertow 1.4.24.Final",
                  },
               ],
            },
         ],
         datePublic: "2018-03-12T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-12-05T10:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2018:0479",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0479",
            },
            {
               name: "RHSA-2018:0481",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0481",
            },
            {
               name: "RHSA-2018:2405",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2405",
            },
            {
               name: "RHSA-2018:1525",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:1525",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196",
            },
            {
               name: "RHSA-2018:0480",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0480",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://issues.jboss.org/browse/UNDERTOW-1190",
            },
            {
               name: "RHSA-2018:3768",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3768",
            },
            {
               name: "RHSA-2018:0478",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:0478",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2017-12196",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "undertow",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "undertow 1.4.18.SP1",
                                       },
                                       {
                                          version_value: " undertow 2.0.2.Final",
                                       },
                                       {
                                          version_value: " undertow 1.4.24.Final",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "4.8/CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-287",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "RHSA-2018:0479",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0479",
                  },
                  {
                     name: "RHSA-2018:0481",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0481",
                  },
                  {
                     name: "RHSA-2018:2405",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2405",
                  },
                  {
                     name: "RHSA-2018:1525",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:1525",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196",
                  },
                  {
                     name: "RHSA-2018:0480",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0480",
                  },
                  {
                     name: "https://issues.jboss.org/browse/UNDERTOW-1190",
                     refsource: "CONFIRM",
                     url: "https://issues.jboss.org/browse/UNDERTOW-1190",
                  },
                  {
                     name: "RHSA-2018:3768",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3768",
                  },
                  {
                     name: "RHSA-2018:0478",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:0478",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2017-12196",
      datePublished: "2018-04-18T01:00:00",
      dateReserved: "2017-08-01T00:00:00",
      dateUpdated: "2024-08-05T18:28:16.713Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-10172
Vulnerability from cvelistv5
Published
2019-11-18 16:16
Modified
2024-08-04 22:10
Severity ?
5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172x_refsource_CONFIRM
https://lists.debian.org/debian-lts-announce/2020/01/msg00037.htmlmailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.debian.org/debian-lts-announce/2020/08/msg00039.htmlmailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3Emailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
Redhat jackson-mapper-asl Version: 1.9.x
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T22:10:09.989Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172",
               },
               {
                  name: "[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html",
               },
               {
                  name: "[cassandra-commits] 20200407 [jira] [Created] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200413 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200420 [jira] [Updated] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200420 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200420 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200818 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200818 [jira] [Created] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200819 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html",
               },
               {
                  name: "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20200825 [jira] [Updated] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20200825 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200901 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20200901 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E",
               },
               {
                  name: "[hadoop-user] 20210317 jackson-mapper-asl vulnerability at Hadoop",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E",
               },
               {
                  name: "[hive-issues] 20210318 [jira] [Updated] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E",
               },
               {
                  name: "[hive-issues] 20210318 [jira] [Assigned] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E",
               },
               {
                  name: "[hive-dev] 20210318 [jira] [Created] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E",
               },
               {
                  name: "[hive-issues] 20210318 [jira] [Commented] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E",
               },
               {
                  name: "[hive-dev] 20210318 CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E",
               },
               {
                  name: "[hive-issues] 20210318 [jira] [Comment Edited] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210320 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hive-issues] 20210729 [jira] [Resolved] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210906 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210907 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210920 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210921 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210924 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210924 [jira] [Updated] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20210926 [jira] [Commented] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[hadoop-common-issues] 20210927 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E",
               },
               {
                  name: "[cassandra-commits] 20210927 [jira] [Assigned] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "jackson-mapper-asl",
               vendor: "Redhat",
               versions: [
                  {
                     status: "affected",
                     version: "1.9.x",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-611",
                     description: "CWE-611",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-09-27T09:06:11",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172",
            },
            {
               name: "[debian-lts-announce] 20200131 [SECURITY] [DLA 2091-1] libjackson-json-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html",
            },
            {
               name: "[cassandra-commits] 20200407 [jira] [Created] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200413 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200420 [jira] [Updated] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200420 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200420 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200818 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200818 [jira] [Created] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200819 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20200824 [SECURITY] [DLA 2342-1] libjackson-json-java security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html",
            },
            {
               name: "[hadoop-common-issues] 20200824 [jira] [Created] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-dev] 20200824 [jira] [Created] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20200825 [jira] [Updated] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20200825 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200901 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20200901 [jira] [Commented] (CASSANDRA-15701) Does Cassandra 3.11.3/3.11.5 is affected by CVE-2019-10712 or not ?",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[spark-issues] 20210223 [jira] [Created] (SPARK-34511) Current Security vulnerabilities in spark libraries",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E",
            },
            {
               name: "[hadoop-user] 20210317 jackson-mapper-asl vulnerability at Hadoop",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E",
            },
            {
               name: "[hive-issues] 20210318 [jira] [Updated] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E",
            },
            {
               name: "[hive-issues] 20210318 [jira] [Assigned] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E",
            },
            {
               name: "[hive-dev] 20210318 [jira] [Created] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E",
            },
            {
               name: "[hive-issues] 20210318 [jira] [Commented] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E",
            },
            {
               name: "[hive-dev] 20210318 CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E",
            },
            {
               name: "[hive-issues] 20210318 [jira] [Comment Edited] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210320 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hive-issues] 20210729 [jira] [Resolved] (HIVE-24904) CVE-2019-10172,CVE-2019-10202 vulnerabilities in jackson-mapper-asl-1.9.13.jar",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210906 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210907 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210920 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210921 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210924 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210924 [jira] [Updated] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20210926 [jira] [Commented] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[hadoop-common-issues] 20210927 [jira] [Commented] (HADOOP-17225) Update jackson-mapper-asl-1.9.13 to atlassian version to mitigate: CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20210927 [jira] [Updated] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E",
            },
            {
               name: "[cassandra-commits] 20210927 [jira] [Assigned] (CASSANDRA-16056) Remove jackson-mapper-asl-1.9.13 to mitigate CVE-2019-10172",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-10172",
      datePublished: "2019-11-18T16:16:02",
      dateReserved: "2019-03-27T00:00:00",
      dateUpdated: "2024-08-04T22:10:09.989Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-7501
Vulnerability from cvelistv5
Published
2017-11-09 00:00
Modified
2024-08-06 07:51
Severity ?
Summary
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
References
http://rhn.redhat.com/errata/RHSA-2016-0040.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2670.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2501.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2517.htmlvendor-advisory
http://www.securityfocus.com/bid/78215vdb-entry
http://www.securitytracker.com/id/1034097vdb-entry
http://rhn.redhat.com/errata/RHSA-2015-2671.htmlvendor-advisory
http://www.securitytracker.com/id/1037052vdb-entry
http://www.securitytracker.com/id/1037640vdb-entry
http://rhn.redhat.com/errata/RHSA-2015-2522.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2521.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2516.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2500.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2514.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2502.htmlvendor-advisory
https://rhn.redhat.com/errata/RHSA-2015-2536.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2016-1773.htmlvendor-advisory
http://rhn.redhat.com/errata/RHSA-2015-2524.htmlvendor-advisory
http://www.securitytracker.com/id/1037053vdb-entry
https://bugzilla.redhat.com/show_bug.cgi?id=1279330
https://access.redhat.com/solutions/2045023
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
https://access.redhat.com/security/vulnerabilities/2059393
http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
https://www.oracle.com/security-alerts/cpujul2020.html
https://security.netapp.com/advisory/ntap-20240216-0010/
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T07:51:28.224Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2016:0040",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-0040.html",
               },
               {
                  name: "RHSA-2015:2670",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2670.html",
               },
               {
                  name: "RHSA-2015:2501",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2501.html",
               },
               {
                  name: "RHSA-2015:2517",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2517.html",
               },
               {
                  name: "78215",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/78215",
               },
               {
                  name: "1034097",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1034097",
               },
               {
                  name: "RHSA-2015:2671",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2671.html",
               },
               {
                  name: "1037052",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037052",
               },
               {
                  name: "1037640",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037640",
               },
               {
                  name: "RHSA-2015:2522",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2522.html",
               },
               {
                  name: "RHSA-2015:2521",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2521.html",
               },
               {
                  name: "RHSA-2015:2516",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2516.html",
               },
               {
                  name: "RHSA-2015:2500",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2500.html",
               },
               {
                  name: "RHSA-2015:2514",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2514.html",
               },
               {
                  name: "RHSA-2015:2502",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2502.html",
               },
               {
                  name: "RHSA-2015:2536",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://rhn.redhat.com/errata/RHSA-2015-2536.html",
               },
               {
                  name: "RHSA-2016:1773",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2016-1773.html",
               },
               {
                  name: "RHSA-2015:2524",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-2524.html",
               },
               {
                  name: "1037053",
                  tags: [
                     "vdb-entry",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1037053",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/solutions/2045023",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/vulnerabilities/2059393",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20240216-0010/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-11-06T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-02-16T13:06:08.221728",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2016:0040",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-0040.html",
            },
            {
               name: "RHSA-2015:2670",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2670.html",
            },
            {
               name: "RHSA-2015:2501",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2501.html",
            },
            {
               name: "RHSA-2015:2517",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2517.html",
            },
            {
               name: "78215",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securityfocus.com/bid/78215",
            },
            {
               name: "1034097",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1034097",
            },
            {
               name: "RHSA-2015:2671",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2671.html",
            },
            {
               name: "1037052",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1037052",
            },
            {
               name: "1037640",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1037640",
            },
            {
               name: "RHSA-2015:2522",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2522.html",
            },
            {
               name: "RHSA-2015:2521",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2521.html",
            },
            {
               name: "RHSA-2015:2516",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2516.html",
            },
            {
               name: "RHSA-2015:2500",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2500.html",
            },
            {
               name: "RHSA-2015:2514",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2514.html",
            },
            {
               name: "RHSA-2015:2502",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2502.html",
            },
            {
               name: "RHSA-2015:2536",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://rhn.redhat.com/errata/RHSA-2015-2536.html",
            },
            {
               name: "RHSA-2016:1773",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2016-1773.html",
            },
            {
               name: "RHSA-2015:2524",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-2524.html",
            },
            {
               name: "1037053",
               tags: [
                  "vdb-entry",
               ],
               url: "http://www.securitytracker.com/id/1037053",
            },
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
            },
            {
               url: "https://access.redhat.com/solutions/2045023",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
            },
            {
               url: "https://access.redhat.com/security/vulnerabilities/2059393",
            },
            {
               url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20240216-0010/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2015-7501",
      datePublished: "2017-11-09T00:00:00",
      dateReserved: "2015-09-29T00:00:00",
      dateUpdated: "2024-08-06T07:51:28.224Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14887
Vulnerability from cvelistv5
Published
2020-03-16 14:48
Modified
2024-08-05 00:26
Severity ?
7.4 (High) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887x_refsource_CONFIRM
https://issues.redhat.com/browse/JBEAP-17965x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20200327-0007/x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat wildfly Version: 7.2.0.GA, 7.2.3.GA, 7.2.5.CR2
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.145Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://issues.redhat.com/browse/JBEAP-17965",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200327-0007/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "7.2.0.GA, 7.2.3.GA, 7.2.5.CR2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.4,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-757",
                     description: "CWE-757",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-03-27T08:06:03",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://issues.redhat.com/browse/JBEAP-17965",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200327-0007/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14887",
      datePublished: "2020-03-16T14:48:09",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.145Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-10734
Vulnerability from cvelistv5
Published
2021-02-11 15:29
Modified
2024-08-04 11:14
Severity ?
Summary
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1831662x_refsource_MISC
https://issues.redhat.com/browse/KEYCLOAK-13653x_refsource_MISC
Impacted products
Vendor Product Version
n/a keycloak Version: As shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T11:14:14.684Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1831662",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://issues.redhat.com/browse/KEYCLOAK-13653",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "keycloak",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "As shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-352",
                     description: "CWE-352",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-11T15:29:45",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1831662",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://issues.redhat.com/browse/KEYCLOAK-13653",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-10734",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "keycloak",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "As shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-352",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1831662",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1831662",
                  },
                  {
                     name: "https://issues.redhat.com/browse/KEYCLOAK-13653",
                     refsource: "MISC",
                     url: "https://issues.redhat.com/browse/KEYCLOAK-13653",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-10734",
      datePublished: "2021-02-11T15:29:45",
      dateReserved: "2020-03-20T00:00:00",
      dateUpdated: "2024-08-04T11:14:14.684Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-4104
Vulnerability from cvelistv5
Published
2021-12-14 00:00
Modified
2024-08-03 17:16
Severity ?
Summary
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
References
https://www.cve.org/CVERecord?id=CVE-2021-44228
https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
https://access.redhat.com/security/cve/CVE-2021-4104
https://www.kb.cert.org/vuls/id/930724third-party-advisory
http://www.openwall.com/lists/oss-security/2022/01/18/3mailing-list
https://www.oracle.com/security-alerts/cpujan2022.html
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
https://security.netapp.com/advisory/ntap-20211223-0007/
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpujul2022.html
https://security.gentoo.org/glsa/202209-02vendor-advisory
https://security.gentoo.org/glsa/202310-16vendor-advisory
https://security.gentoo.org/glsa/202312-02vendor-advisory
https://security.gentoo.org/glsa/202312-04vendor-advisory
Impacted products
Vendor Product Version
Apache Software Foundation Apache Log4j 1.x Version: Apache Log4j 1.2 1.2.x
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T17:16:04.172Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cve.org/CVERecord?id=CVE-2021-44228",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2021-4104",
               },
               {
                  name: "VU#930724",
                  tags: [
                     "third-party-advisory",
                     "x_transferred",
                  ],
                  url: "https://www.kb.cert.org/vuls/id/930724",
               },
               {
                  name: "[oss-security] 20220118 CVE-2022-23302: Deserialization of untrusted data in JMSSink in Apache Log4j 1.x",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2022/01/18/3",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20211223-0007/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
               {
                  name: "GLSA-202209-02",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202209-02",
               },
               {
                  name: "GLSA-202310-16",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202310-16",
               },
               {
                  name: "GLSA-202312-02",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-02",
               },
               {
                  name: "GLSA-202312-04",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202312-04",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Log4j 1.x",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     status: "affected",
                     version: "Apache Log4j 1.2 1.2.x",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502 Deserialization of Untrusted Data",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-12-22T09:06:15.357899",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               url: "https://www.cve.org/CVERecord?id=CVE-2021-44228",
            },
            {
               url: "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
            },
            {
               url: "https://access.redhat.com/security/cve/CVE-2021-4104",
            },
            {
               name: "VU#930724",
               tags: [
                  "third-party-advisory",
               ],
               url: "https://www.kb.cert.org/vuls/id/930724",
            },
            {
               name: "[oss-security] 20220118 CVE-2022-23302: Deserialization of untrusted data in JMSSink in Apache Log4j 1.x",
               tags: [
                  "mailing-list",
               ],
               url: "http://www.openwall.com/lists/oss-security/2022/01/18/3",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujan2022.html",
            },
            {
               url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20211223-0007/",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
            },
            {
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
            {
               name: "GLSA-202209-02",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202209-02",
            },
            {
               name: "GLSA-202310-16",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202310-16",
            },
            {
               name: "GLSA-202312-02",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-02",
            },
            {
               name: "GLSA-202312-04",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202312-04",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2",
         x_generator: {
            engine: "Vulnogram 0.0.9",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2021-4104",
      datePublished: "2021-12-14T00:00:00",
      dateReserved: "2021-12-13T00:00:00",
      dateUpdated: "2024-08-03T17:16:04.172Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-8648
Vulnerability from cvelistv5
Published
2018-08-01 14:00
Modified
2024-08-06 02:27
Severity ?
7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
References
http://www.securityfocus.com/bid/94513vdb-entry, x_refsource_BID
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648x_refsource_CONFIRM
Impacted products
Vendor Product Version
Apache Software Foundation Karaf Version: As shipped with Jboss Fuse 6.x
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:27:41.427Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94513",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94513",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Karaf",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     status: "affected",
                     version: "As shipped with Jboss Fuse 6.x",
                  },
               ],
            },
         ],
         datePublic: "2016-11-24T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-08-02T09:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "94513",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94513",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-8648",
      datePublished: "2018-08-01T14:00:00",
      dateReserved: "2016-10-12T00:00:00",
      dateUpdated: "2024-08-06T02:27:41.427Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-27782
Vulnerability from cvelistv5
Published
2021-02-23 18:35
Modified
2024-08-04 16:25
Severity ?
Summary
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1901304x_refsource_MISC
Impacted products
Vendor Product Version
n/a Undertow Version: 2.1.5.SP1
Version: 2.0.33.SP2
Version: 2.2.3.SP1
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T16:25:42.926Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1901304",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Undertow",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "2.1.5.SP1",
                  },
                  {
                     status: "affected",
                     version: "2.0.33.SP2",
                  },
                  {
                     status: "affected",
                     version: "2.2.3.SP1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-23T18:35:52",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1901304",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-27782",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Undertow",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "2.1.5.SP1",
                                       },
                                       {
                                          version_value: "2.0.33.SP2",
                                       },
                                       {
                                          version_value: "2.2.3.SP1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1901304",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1901304",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-27782",
      datePublished: "2021-02-23T18:35:52",
      dateReserved: "2020-10-27T00:00:00",
      dateUpdated: "2024-08-04T16:25:42.926Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2013-7397
Vulnerability from cvelistv5
Published
2015-06-24 16:00
Modified
2024-08-06 18:09
Severity ?
Summary
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
References
http://rhn.redhat.com/errata/RHSA-2015-0850.htmlvendor-advisory, x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-1176.htmlvendor-advisory, x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-0851.htmlvendor-advisory, x_refsource_REDHAT
http://www.securityfocus.com/bid/69316vdb-entry, x_refsource_BID
https://github.com/AsyncHttpClient/async-http-client/issues/352x_refsource_CONFIRM
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20x_refsource_CONFIRM
http://openwall.com/lists/oss-security/2014/08/26/1mailing-list, x_refsource_MLIST
http://rhn.redhat.com/errata/RHSA-2015-1551.htmlvendor-advisory, x_refsource_REDHAT
https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3Emailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T18:09:16.606Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2015:0850",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
               },
               {
                  name: "RHSA-2015:1176",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
               },
               {
                  name: "RHSA-2015:0851",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
               },
               {
                  name: "69316",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/69316",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/AsyncHttpClient/async-http-client/issues/352",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
               },
               {
                  name: "[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://openwall.com/lists/oss-security/2014/08/26/1",
               },
               {
                  name: "RHSA-2015:1551",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
               },
               {
                  name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
               },
               {
                  name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2013-07-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-16T05:06:32",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "RHSA-2015:0850",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
            },
            {
               name: "RHSA-2015:1176",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
            },
            {
               name: "RHSA-2015:0851",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
            },
            {
               name: "69316",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/69316",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/AsyncHttpClient/async-http-client/issues/352",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
            },
            {
               name: "[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://openwall.com/lists/oss-security/2014/08/26/1",
            },
            {
               name: "RHSA-2015:1551",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
            },
            {
               name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
            },
            {
               name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2013-7397",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "RHSA-2015:0850",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
                  },
                  {
                     name: "RHSA-2015:1176",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
                  },
                  {
                     name: "RHSA-2015:0851",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
                  },
                  {
                     name: "69316",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/69316",
                  },
                  {
                     name: "https://github.com/AsyncHttpClient/async-http-client/issues/352",
                     refsource: "CONFIRM",
                     url: "https://github.com/AsyncHttpClient/async-http-client/issues/352",
                  },
                  {
                     name: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
                     refsource: "CONFIRM",
                     url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
                  },
                  {
                     name: "[oss-security] 20140825 Re: CVE Request: Multiple issues in com.ning:async-http-client",
                     refsource: "MLIST",
                     url: "http://openwall.com/lists/oss-security/2014/08/26/1",
                  },
                  {
                     name: "RHSA-2015:1551",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
                  },
                  {
                     name: "[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E",
                  },
                  {
                     name: "[pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2013-7397",
      datePublished: "2015-06-24T16:00:00",
      dateReserved: "2014-08-25T00:00:00",
      dateUpdated: "2024-08-06T18:09:16.606Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-10714
Vulnerability from cvelistv5
Published
2020-09-23 12:28
Modified
2024-08-04 11:14
Severity ?
Summary
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1825714x_refsource_MISC
https://security.netapp.com/advisory/ntap-20201223-0002/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a wildfly-elytron Version: wildfly-elytron 1.10.7.Final
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T11:14:14.215Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1825714",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20201223-0002/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "wildfly-elytron",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "wildfly-elytron 1.10.7.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-384",
                     description: "CWE-384",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-23T07:06:28",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1825714",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20201223-0002/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-10714",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "wildfly-elytron",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "wildfly-elytron 1.10.7.Final",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-384",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1825714",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1825714",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20201223-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20201223-0002/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-10714",
      datePublished: "2020-09-23T12:28:17",
      dateReserved: "2020-03-20T00:00:00",
      dateUpdated: "2024-08-04T11:14:14.215Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1718
Vulnerability from cvelistv5
Published
2020-05-12 20:25
Modified
2024-08-04 06:46
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
Summary
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat keycloak Version: All versions before 8.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:46:30.307Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "keycloak",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "All versions before 8.0.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-12T20:25:29",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-1718",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "keycloak",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "All versions before 8.0.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.1/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-287",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-1718",
      datePublished: "2020-05-12T20:25:29",
      dateReserved: "2019-11-27T00:00:00",
      dateUpdated: "2024-08-04T06:46:30.307Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-0085
Vulnerability from cvelistv5
Published
2014-04-17 14:00
Modified
2024-08-06 09:05
Severity ?
Summary
JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T09:05:38.518Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2014-04-14T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-08-09T17:57:02",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2014-0085",
      datePublished: "2014-04-17T14:00:00",
      dateReserved: "2013-12-03T00:00:00",
      dateUpdated: "2024-08-06T09:05:38.518Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-2764
Vulnerability from cvelistv5
Published
2022-09-01 00:00
Modified
2024-08-03 00:46
Severity ?
Summary
A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
References
https://bugzilla.redhat.com/show_bug.cgi?id=2117506
https://security.netapp.com/advisory/ntap-20221014-0006/
Impacted products
Vendor Product Version
n/a undertow Version: undertow 2.x
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T00:46:04.429Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2117506",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20221014-0006/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undertow",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "undertow 2.x",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-10-14T00:00:00",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2117506",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20221014-0006/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-2764",
      datePublished: "2022-09-01T00:00:00",
      dateReserved: "2022-08-11T00:00:00",
      dateUpdated: "2024-08-03T00:46:04.429Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-5075
Vulnerability from cvelistv5
Published
2014-10-25 21:00
Modified
2024-08-06 11:34
Severity ?
Summary
The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References
http://secunia.com/advisories/59915third-party-advisory, x_refsource_SECUNIA
http://op-co.de/CVE-2014-5075.htmlx_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2015-1176.htmlvendor-advisory, x_refsource_REDHAT
http://www.securityfocus.com/bid/69064vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T11:34:37.436Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "59915",
                  tags: [
                     "third-party-advisory",
                     "x_refsource_SECUNIA",
                     "x_transferred",
                  ],
                  url: "http://secunia.com/advisories/59915",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://op-co.de/CVE-2014-5075.html",
               },
               {
                  name: "RHSA-2015:1176",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
               },
               {
                  name: "69064",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/69064",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2014-08-05T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2016-11-25T19:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "59915",
               tags: [
                  "third-party-advisory",
                  "x_refsource_SECUNIA",
               ],
               url: "http://secunia.com/advisories/59915",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://op-co.de/CVE-2014-5075.html",
            },
            {
               name: "RHSA-2015:1176",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
            },
            {
               name: "69064",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/69064",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2014-5075",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "59915",
                     refsource: "SECUNIA",
                     url: "http://secunia.com/advisories/59915",
                  },
                  {
                     name: "http://op-co.de/CVE-2014-5075.html",
                     refsource: "CONFIRM",
                     url: "http://op-co.de/CVE-2014-5075.html",
                  },
                  {
                     name: "RHSA-2015:1176",
                     refsource: "REDHAT",
                     url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
                  },
                  {
                     name: "69064",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/69064",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2014-5075",
      datePublished: "2014-10-25T21:00:00",
      dateReserved: "2014-07-24T00:00:00",
      dateUpdated: "2024-08-06T11:34:37.436Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1717
Vulnerability from cvelistv5
Published
2021-02-11 15:27
Modified
2024-08-04 06:46
Severity ?
Summary
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
References
https://bugzilla.redhat.com/show_bug.cgi?id=1796281x_refsource_MISC
https://issues.jboss.org/browse/KEYCLOAK-12014x_refsource_MISC
Impacted products
Vendor Product Version
n/a keycloak Version: keycloak 7.0.1
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:46:29.996Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1796281",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://issues.jboss.org/browse/KEYCLOAK-12014",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "keycloak",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "keycloak 7.0.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-209",
                     description: "CWE-209",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-11T15:27:07",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1796281",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://issues.jboss.org/browse/KEYCLOAK-12014",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-1717",
      datePublished: "2021-02-11T15:27:07",
      dateReserved: "2019-11-27T00:00:00",
      dateUpdated: "2024-08-04T06:46:29.996Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-1000229
Vulnerability from cvelistv5
Published
2019-12-20 13:02
Modified
2024-08-06 03:55
Severity ?
Summary
swagger-ui has XSS in key names
References
https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.jsonx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229x_refsource_MISC
http://www.securityfocus.com/bid/97580x_refsource_MISC
https://access.redhat.com/errata/RHSA-2017:0868x_refsource_MISC
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T03:55:27.059Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/97580",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2017:0868",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "swagger-ui has XSS in key names",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-12-20T13:02:44",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.securityfocus.com/bid/97580",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://access.redhat.com/errata/RHSA-2017:0868",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-1000229",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "swagger-ui has XSS in key names",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json",
                     refsource: "MISC",
                     url: "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json",
                  },
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229",
                  },
                  {
                     name: "http://www.securityfocus.com/bid/97580",
                     refsource: "MISC",
                     url: "http://www.securityfocus.com/bid/97580",
                  },
                  {
                     name: "https://access.redhat.com/errata/RHSA-2017:0868",
                     refsource: "MISC",
                     url: "https://access.redhat.com/errata/RHSA-2017:0868",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-1000229",
      datePublished: "2019-12-20T13:02:44",
      dateReserved: "2016-09-20T00:00:00",
      dateUpdated: "2024-08-06T03:55:27.059Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-8653
Vulnerability from cvelistv5
Published
2018-08-01 14:00
Modified
2024-08-06 02:27
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653x_refsource_CONFIRM
http://www.securityfocus.com/bid/94544vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
Red Hat Fuse Version: 6
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:27:41.292Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653",
               },
               {
                  name: "94544",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94544",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Fuse",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "6",
                  },
               ],
            },
         ],
         datePublic: "2016-11-25T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-08-02T09:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653",
            },
            {
               name: "94544",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94544",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2016-8653",
      datePublished: "2018-08-01T14:00:00",
      dateReserved: "2016-10-12T00:00:00",
      dateUpdated: "2024-08-06T02:27:41.292Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1714
Vulnerability from cvelistv5
Published
2020-05-13 18:25
Modified
2024-08-04 06:46
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714x_refsource_CONFIRM
https://github.com/keycloak/keycloak/pull/7053x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat keycloak Version: before 11.0.0
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:46:30.830Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/keycloak/keycloak/pull/7053",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "keycloak",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "before 11.0.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-13T18:25:56",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/keycloak/keycloak/pull/7053",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-1714",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "keycloak",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "before 11.0.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.5/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-20",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714",
                  },
                  {
                     name: "https://github.com/keycloak/keycloak/pull/7053",
                     refsource: "CONFIRM",
                     url: "https://github.com/keycloak/keycloak/pull/7053",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-1714",
      datePublished: "2020-05-13T18:25:56",
      dateReserved: "2019-11-27T00:00:00",
      dateUpdated: "2024-08-04T06:46:30.830Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-14892
Vulnerability from cvelistv5
Published
2020-03-02 16:28
Modified
2024-08-05 00:26
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/issues/2462x_refsource_MISC
https://access.redhat.com/errata/RHSA-2020:0729vendor-advisory, x_refsource_REDHAT
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Emailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3Emailing-list, x_refsource_MLIST
https://security.netapp.com/advisory/ntap-20200904-0005/x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat jackson-databind Version: Versions before 2.9.10
Version: Versions before 2.8.11.5
Version: Versions before 2.6.7.3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T00:26:39.136Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/FasterXML/jackson-databind/issues/2462",
               },
               {
                  name: "RHSA-2020:0729",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0729",
               },
               {
                  name: "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
               },
               {
                  name: "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200904-0005/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "jackson-databind",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "Versions before 2.9.10",
                  },
                  {
                     status: "affected",
                     version: "Versions before 2.8.11.5",
                  },
                  {
                     status: "affected",
                     version: "Versions before 2.6.7.3",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-502",
                     description: "CWE-502",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-09-04T11:06:13",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/FasterXML/jackson-databind/issues/2462",
            },
            {
               name: "RHSA-2020:0729",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0729",
            },
            {
               name: "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
            },
            {
               name: "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200904-0005/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-14892",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "jackson-databind",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Versions before 2.9.10",
                                       },
                                       {
                                          version_value: "Versions before 2.8.11.5",
                                       },
                                       {
                                          version_value: "Versions before 2.6.7.3",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-502",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892",
                  },
                  {
                     name: "https://github.com/FasterXML/jackson-databind/issues/2462",
                     refsource: "MISC",
                     url: "https://github.com/FasterXML/jackson-databind/issues/2462",
                  },
                  {
                     name: "RHSA-2020:0729",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0729",
                  },
                  {
                     name: "[bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E",
                  },
                  {
                     name: "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20200904-0005/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20200904-0005/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-14892",
      datePublished: "2020-03-02T16:28:40",
      dateReserved: "2019-08-10T00:00:00",
      dateUpdated: "2024-08-05T00:26:39.136Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-0120
Vulnerability from cvelistv5
Published
2017-12-29 22:00
Modified
2024-08-06 09:05
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."
References
https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfx_refsource_MISC
https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=1072681x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T09:05:38.398Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072681",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2014-03-04T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running \"shutdown -f.\"",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-12-29T21:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072681",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2014-0120",
      datePublished: "2017-12-29T22:00:00",
      dateReserved: "2013-12-03T00:00:00",
      dateUpdated: "2024-08-06T09:05:38.398Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-2053
Vulnerability from cvelistv5
Published
2022-08-05 15:24
Modified
2024-08-03 00:24
Severity ?
Summary
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.
References
https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0x_refsource_MISC
https://issues.redhat.com/browse/UNDERTOW-2133x_refsource_MISC
Impacted products
Vendor Product Version
n/a Undertow Version: Fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T00:24:44.066Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://issues.redhat.com/browse/UNDERTOW-2133",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Undertow",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "Fixed in Undertow 2.2.19.Final,  Undertow 2.3.0.Alpha2",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in \"All workers are in error state\" and mod_cluster responds \"503 Service Unavailable\" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the \"retry\" timeout passes. However, luckily, mod_proxy_balancer has \"forcerecovery\" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding \"503 Service Unavailable\". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-08-05T15:24:26",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://issues.redhat.com/browse/UNDERTOW-2133",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2022-2053",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Undertow",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Fixed in Undertow 2.2.19.Final,  Undertow 2.3.0.Alpha2",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in \"All workers are in error state\" and mod_cluster responds \"503 Service Unavailable\" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the \"retry\" timeout passes. However, luckily, mod_proxy_balancer has \"forcerecovery\" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding \"503 Service Unavailable\". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-400",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0",
                  },
                  {
                     name: "https://issues.redhat.com/browse/UNDERTOW-2133",
                     refsource: "MISC",
                     url: "https://issues.redhat.com/browse/UNDERTOW-2133",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-2053",
      datePublished: "2022-08-05T15:24:27",
      dateReserved: "2022-06-10T00:00:00",
      dateUpdated: "2024-08-03T00:24:44.066Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1757
Vulnerability from cvelistv5
Published
2020-04-21 15:31
Modified
2024-08-04 06:46
Severity ?
8.1 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757x_refsource_CONFIRM
Impacted products
Vendor Product Version
Red Hat undertow Version: all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1
Version: all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:46:30.881Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undertow",
               vendor: "Red Hat",
               versions: [
                  {
                     status: "affected",
                     version: "all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1",
                  },
                  {
                     status: "affected",
                     version: "all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 8.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-20",
                     description: "CWE-20",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-200",
                     description: "CWE-200",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-04-21T15:31:14",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2020-1757",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "undertow",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1",
                                       },
                                       {
                                          version_value: "all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Red Hat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "8.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-20",
                        },
                     ],
                  },
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-200",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2020-1757",
      datePublished: "2020-04-21T15:31:14",
      dateReserved: "2019-11-27T00:00:00",
      dateUpdated: "2024-08-04T06:46:30.881Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2019-10212
Vulnerability from cvelistv5
Published
2019-10-02 18:22
Modified
2024-08-04 22:17
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
Summary
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
References
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2019:2998vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2020:0727vendor-advisory, x_refsource_REDHAT
https://security.netapp.com/advisory/ntap-20220210-0017/x_refsource_CONFIRM
Impacted products
Vendor Product Version
RedHat undertow Version: all under 2.0.20
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T22:17:18.906Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212",
               },
               {
                  name: "RHSA-2019:2998",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:2998",
               },
               {
                  name: "RHSA-2020:0727",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0727",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20220210-0017/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "undertow",
               vendor: "RedHat",
               versions: [
                  {
                     status: "affected",
                     version: "all under 2.0.20",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.",
            },
         ],
         metrics: [
            {
               cvssV3_0: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 4.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "LOW",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
                  version: "3.0",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-532",
                     description: "CWE-532",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-02-10T09:06:38",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212",
            },
            {
               name: "RHSA-2019:2998",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:2998",
            },
            {
               name: "RHSA-2020:0727",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0727",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20220210-0017/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2019-10212",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "undertow",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "all under 2.0.20",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "RedHat",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.",
                  },
               ],
            },
            impact: {
               cvss: [
                  [
                     {
                        vectorString: "4.8/CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
                        version: "3.0",
                     },
                  ],
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-532",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212",
                  },
                  {
                     name: "RHSA-2019:2998",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2019:2998",
                  },
                  {
                     name: "RHSA-2020:0727",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0727",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20220210-0017/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20220210-0017/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2019-10212",
      datePublished: "2019-10-02T18:22:08",
      dateReserved: "2019-03-27T00:00:00",
      dateUpdated: "2024-08-04T22:17:18.906Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-20218
Vulnerability from cvelistv5
Published
2021-03-16 21:00
Modified
2024-08-03 17:30
Severity ?
Summary
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
References
https://bugzilla.redhat.com/show_bug.cgi?id=1923405x_refsource_MISC
https://github.com/fabric8io/kubernetes-client/issues/2715x_refsource_MISC
Impacted products
Vendor Product Version
n/a fabric8-kubernetes-client Version: kubernetes-client-4.2.0 and after
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T17:30:07.581Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1923405",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/fabric8io/kubernetes-client/issues/2715",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "fabric8-kubernetes-client",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "kubernetes-client-4.2.0 and after",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-22",
                     description: "CWE-22",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-03-16T21:00:32",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1923405",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/fabric8io/kubernetes-client/issues/2715",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               ID: "CVE-2021-20218",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "fabric8-kubernetes-client",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "kubernetes-client-4.2.0 and after",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-22",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1923405",
                     refsource: "MISC",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1923405",
                  },
                  {
                     name: "https://github.com/fabric8io/kubernetes-client/issues/2715",
                     refsource: "MISC",
                     url: "https://github.com/fabric8io/kubernetes-client/issues/2715",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2021-20218",
      datePublished: "2021-03-16T21:00:32",
      dateReserved: "2020-12-17T00:00:00",
      dateUpdated: "2024-08-03T17:30:07.581Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2014-8175
Vulnerability from cvelistv5
Published
2015-07-08 15:00
Modified
2024-08-06 13:10
Severity ?
Summary
Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file.
References
http://rhn.redhat.com/errata/RHSA-2015-1176.htmlvendor-advisory, x_refsource_REDHAT
http://rhn.redhat.com/errata/RHSA-2015-1177.htmlvendor-advisory, x_refsource_REDHAT
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T13:10:51.127Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "RHSA-2015:1176",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
               },
               {
                  name: "RHSA-2015:1177",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "http://rhn.redhat.com/errata/RHSA-2015-1177.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-06-23T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2015-07-08T14:57:01",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               name: "RHSA-2015:1176",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
            },
            {
               name: "RHSA-2015:1177",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "http://rhn.redhat.com/errata/RHSA-2015-1177.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2014-8175",
      datePublished: "2015-07-08T15:00:00",
      dateReserved: "2014-10-10T00:00:00",
      dateUpdated: "2024-08-06T13:10:51.127Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2022-4492
Vulnerability from cvelistv5
Published
2023-02-23 00:00
Modified
2025-03-12 14:34
Severity ?
Summary
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
References
https://bugzilla.redhat.com/show_bug.cgi?id=2153260
https://access.redhat.com/security/cve/CVE-2022-4492
https://security.netapp.com/advisory/ntap-20230324-0002/
Impacted products
Vendor Product Version
n/a undertow Version: 2.7
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T01:41:45.097Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=2153260",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/security/cve/CVE-2022-4492",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20230324-0002/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2022-4492",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-12T14:33:53.756138Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        cweId: "CWE-918",
                        description: "CWE-918 Server-Side Request Forgery (SSRF)",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-12T14:34:50.123Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "undertow",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "2.7",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "ssrf",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-03-24T00:00:00.000Z",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=2153260",
            },
            {
               url: "https://access.redhat.com/security/cve/CVE-2022-4492",
            },
            {
               url: "https://security.netapp.com/advisory/ntap-20230324-0002/",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2022-4492",
      datePublished: "2023-02-23T00:00:00.000Z",
      dateReserved: "2022-12-14T00:00:00.000Z",
      dateUpdated: "2025-03-12T14:34:50.123Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd
Published
2022-09-01 21:15
Modified
2024-11-21 07:01
Severity ?
4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2117506Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20221014-0006/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2117506Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20221014-0006/Third Party Advisory
Impacted products
Vendor Product Version
redhat integration_camel_k -
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 7.0.0
redhat single_sign-on 7.0
redhat undertow *
redhat undertow 2.3.0
redhat undertow 2.3.0
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp cloud_secure_agent -
netapp oncommand_insight -
netapp oncommand_workflow_automation -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "AB97356C-3998-431D-892D-F97E2DD8E18D",
                     versionEndIncluding: "2.2.19",
                     versionStartIncluding: "2.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.3.0:alpha1:*:*:*:*:*:*",
                     matchCriteriaId: "F6DD3DE4-9C5D-4768-9414-C63D1D172B7F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.3.0:alpha2:*:*:*:*:*:*",
                     matchCriteriaId: "733DA120-19EF-45C2-96C0-C9367DF6EE28",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
                     matchCriteriaId: "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                     matchCriteriaId: "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                     matchCriteriaId: "B55E8D50-99B4-47EC-86F9-699B67D473CE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:cloud_secure_agent:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F0F202E8-97E6-4BBB-A0B6-4CA3F5803C08",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5735E553-9731-4AAC-BCFF-989377F817B3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.",
      },
      {
         lang: "es",
         value: "Se ha encontrado un fallo en Undertow. Puede producirse una denegación de servicio ya que el servidor de Undertow espera eternamente el LAST_CHUNK para las invocaciones EJB",
      },
   ],
   id: "CVE-2022-2764",
   lastModified: "2024-11-21T07:01:39.693",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 4.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-09-01T21:15:09.807",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2117506",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20221014-0006/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2117506",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20221014-0006/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2013-09-30 21:55
Modified
2025-04-11 00:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
References
secalert@redhat.comhttp://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68
secalert@redhat.comhttp://fusesource.com/issues/browse/FMC-495Vendor Advisory
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1286.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1862.html
secalert@redhat.comhttp://www.securityfocus.com/bid/62659
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1011736Patch
secalert@redhat.comhttps://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5Exploit, Patch
af854a3a-2127-422b-91ae-364da2661108http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68
af854a3a-2127-422b-91ae-364da2661108http://fusesource.com/issues/browse/FMC-495Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1286.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2013-1862.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/62659
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1011736Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5Exploit, Patch
Impacted products
Vendor Product Version
redhat jboss_a-mq 6.0.0
redhat jboss_fuse 6.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C4404A-CFB7-4B47-9487-F998825C31CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.",
      },
      {
         lang: "es",
         value: "Múltiples vulnerabilidades de XSS en Fuse Management Console en Red Hat JBoss Fuse 6.0.0 anterior al parche 3 y JBoss A-MQ 6.0.0 anterior al parche 3 permite a atacantes remotos inyectar script web o HTML arbitrario a través de (1) campos de usuario en la página de creación de usuarios o (2) en la versión de perfil de la página de creación de perfiles.",
      },
   ],
   id: "CVE-2013-4372",
   lastModified: "2025-04-11T00:51:21.963",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
   },
   published: "2013-09-30T21:55:07.377",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://fusesource.com/issues/browse/FMC-495",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1286.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1862.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.securityfocus.com/bid/62659",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1011736",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Exploit",
            "Patch",
         ],
         url: "https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://fusesource.com/forge/git/fuseenterprise.git/?p=fuseenterprise.git%3Ba=commitdiff%3Bh=f5436ea1c5547c851bb6f92561272fe42c146e68",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "http://fusesource.com/issues/browse/FMC-495",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1286.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2013-1862.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/62659",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1011736",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Patch",
         ],
         url: "https://github.com/jboss-fuse/fuse/commit/e280cb370323eeb759030919d5111ed809e8ded5",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-10-06 14:15
Modified
2024-11-21 05:18
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1885485Issue Tracking, Patch, Vendor Advisory
secalert@redhat.comhttps://github.com/wildfly-security/wildfly-openssl-natives/pull/4/filesPatch, Third Party Advisory
secalert@redhat.comhttps://issues.redhat.com/browse/WFSSL-51Permissions Required, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20201016-0004/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1885485Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/filesPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.redhat.com/browse/WFSSL-51Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201016-0004/Third Party Advisory
Impacted products
Vendor Product Version
redhat wildfly_openssl *
redhat data_grid 8.0
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0
netapp oncommand_insight -
netapp oncommand_workflow_automation -
netapp service_level_manager -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly_openssl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "290F30D1-B0BF-42C3-B5EC-09746D88C2C6",
                     versionEndExcluding: "1.1.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7095200A-4DAC-4433-99E8-86CA88E1E4D4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5735E553-9731-4AAC-BCFF-989377F817B3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7081652A-D28B-494E-94EF-CA88117F23EE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo de pérdida de memoria en WildFly OpenSSL en versiones anteriores a 1.1.3.Final, donde se elimina una sesión HTTP.&#xa0;Puede permitir a un atacante causar OOM conllevando a una denegación de servicio.&#xa0;La mayor amenaza de esta vulnerabilidad es la disponibilidad del sistema",
      },
   ],
   id: "CVE-2020-25644",
   lastModified: "2024-11-21T05:18:19.370",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-10-06T14:15:12.760",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1885485",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Permissions Required",
            "Vendor Advisory",
         ],
         url: "https://issues.redhat.com/browse/WFSSL-51",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20201016-0004/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1885485",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/wildfly-security/wildfly-openssl-natives/pull/4/files",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Permissions Required",
            "Vendor Advisory",
         ],
         url: "https://issues.redhat.com/browse/WFSSL-51",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20201016-0004/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-401",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-401",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-08-01 14:29
Modified
2024-11-21 02:59
Severity ?
7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.
References
secalert@redhat.comhttp://www.securityfocus.com/bid/94513Third Party Advisory, VDB Entry
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648Issue Tracking, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94513Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648Issue Tracking, Mitigation, Third Party Advisory
Impacted products
Vendor Product Version
redhat jboss_a-mq 6.0.0
redhat jboss_fuse 6.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C4404A-CFB7-4B47-9487-F998825C31CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath.",
      },
      {
         lang: "es",
         value: "Se ha detectado que el contenedor Karaf empleado por Red Hat JBoss Fuse 6.x y Red Hat JBoss A-MQ 6.x deserializa los objetos que se pasan a MBeans mediante operaciones JMX. Un atacante podría emplear este error para ejecutar código remoto en el servidor como el usuario que ejecuta la máquina virtual de Java si el MBean objetivo contiene gadgets de deserialización en su ruta de clase.",
      },
   ],
   id: "CVE-2016-8648",
   lastModified: "2024-11-21T02:59:45.650",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.2,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.2,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-08-01T14:29:00.300",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94513",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94513",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-01-23 17:15
Modified
2024-11-21 04:27
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20220211-0001/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220211-0001/Third Party Advisory
Impacted products
Vendor Product Version
redhat undertow *
redhat jboss_data_grid -
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 6.0.0
redhat jboss_fuse 7.0.0
redhat single_sign-on 7.0
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "15A116E1-B5F3-4897-BD1B-59419E7A09C3",
                     versionEndIncluding: "2.0.28",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*",
                     matchCriteriaId: "2BF03A52-4068-47EA-8846-1E5FB708CE1A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
                     matchCriteriaId: "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                     matchCriteriaId: "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                     matchCriteriaId: "B55E8D50-99B4-47EC-86F9-699B67D473CE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.",
      },
      {
         lang: "es",
         value: "Se detectó una vulnerabilidad en el servidor HTTP Undertow en versiones anteriores a 2.0.28.SP1, al escuchar sobre HTTPS. Un atacante puede apuntar al puerto HTTPS para llevar a cabo una Denegación de Servicio (DOS) para hacer que el servicio no esté disponible en SSL.",
      },
   ],
   id: "CVE-2019-14888",
   lastModified: "2024-11-21T04:27:36.977",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-01-23T17:15:11.767",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2020:0729",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20220211-0001/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2020:0729",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14888",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20220211-0001/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-12-14 12:15
Modified
2024-11-21 06:36
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
References
security@apache.orghttp://www.openwall.com/lists/oss-security/2022/01/18/3
security@apache.orghttps://access.redhat.com/security/cve/CVE-2021-4104
security@apache.orghttps://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
security@apache.orghttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
security@apache.orghttps://security.gentoo.org/glsa/202209-02
security@apache.orghttps://security.gentoo.org/glsa/202310-16
security@apache.orghttps://security.gentoo.org/glsa/202312-02
security@apache.orghttps://security.gentoo.org/glsa/202312-04
security@apache.orghttps://security.netapp.com/advisory/ntap-20211223-0007/
security@apache.orghttps://www.cve.org/CVERecord?id=CVE-2021-44228
security@apache.orghttps://www.kb.cert.org/vuls/id/930724
security@apache.orghttps://www.oracle.com/security-alerts/cpuapr2022.html
security@apache.orghttps://www.oracle.com/security-alerts/cpujan2022.html
security@apache.orghttps://www.oracle.com/security-alerts/cpujul2022.html
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2022/01/18/3
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2021-4104
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126
af854a3a-2127-422b-91ae-364da2661108https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202209-02
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202310-16
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202312-02
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202312-04
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20211223-0007/
af854a3a-2127-422b-91ae-364da2661108https://www.cve.org/CVERecord?id=CVE-2021-44228
af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/930724
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.html
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2022.html
Impacted products
Vendor Product Version
apache log4j 1.2
fedoraproject fedora 35
redhat codeready_studio 12.0
redhat integration_camel_k -
redhat integration_camel_quarkus -
redhat jboss_a-mq 6.0.0
redhat jboss_a-mq 7
redhat jboss_a-mq_streaming -
redhat jboss_data_grid 7.0.0
redhat jboss_data_virtualization 6.0.0
redhat jboss_enterprise_application_platform 6.0.0
redhat jboss_enterprise_application_platform 7.0
redhat jboss_fuse 6.0.0
redhat jboss_fuse 7.0.0
redhat jboss_fuse_service_works 6.0
redhat jboss_operations_network 3.0
redhat jboss_web_server 3.0
redhat openshift_application_runtimes -
redhat openshift_container_platform 4.6
redhat openshift_container_platform 4.7
redhat openshift_container_platform 4.8
redhat process_automation 7.0
redhat single_sign-on 7.0
redhat software_collections -
redhat enterprise_linux 6.0
redhat enterprise_linux 7.0
redhat enterprise_linux 8.0
oracle advanced_supply_chain_planning 12.1
oracle advanced_supply_chain_planning 12.2
oracle business_intelligence 5.9.0.0.0
oracle business_intelligence 12.2.1.3.0
oracle business_intelligence 12.2.1.4.0
oracle business_process_management_suite 12.2.1.3.0
oracle business_process_management_suite 12.2.1.4.0
oracle communications_eagle_ftp_table_base_retrieval 4.5
oracle communications_messaging_server 8.1
oracle communications_network_integrity 7.3.6
oracle communications_offline_mediation_controller *
oracle communications_offline_mediation_controller 12.0.0.5.0
oracle communications_unified_inventory_management 7.3.4
oracle communications_unified_inventory_management 7.3.5
oracle communications_unified_inventory_management 7.4.1
oracle communications_unified_inventory_management 7.4.2
oracle e-business_suite_cloud_manager_and_cloud_backup_module 2.2.1.1.1
oracle enterprise_manager_base_platform 13.4.0.0
oracle enterprise_manager_base_platform 13.5.0.0
oracle financial_services_revenue_management_and_billing_analytics 2.7.0.0
oracle financial_services_revenue_management_and_billing_analytics 2.7.0.1
oracle financial_services_revenue_management_and_billing_analytics 2.8.0.0
oracle fusion_middleware_common_libraries_and_tools 12.2.1.4.0
oracle goldengate -
oracle healthcare_data_repository 8.1.0
oracle hyperion_data_relationship_management *
oracle hyperion_infrastructure_technology *
oracle identity_management_suite 12.2.1.3.0
oracle identity_management_suite 12.2.1.4.0
oracle jdeveloper 12.2.1.3.0
oracle mysql_enterprise_monitor *
oracle retail_allocation 14.1.3.2
oracle retail_allocation 15.0.3.1
oracle retail_allocation 16.0.3
oracle retail_allocation 19.0.1
oracle retail_extract_transform_and_load 13.2.5
oracle stream_analytics -
oracle timesten_grid -
oracle tuxedo 12.2.2.0.0
oracle utilities_testing_accelerator 6.0.0.1.1
oracle utilities_testing_accelerator 6.0.0.2.2
oracle utilities_testing_accelerator 6.0.0.3.1
oracle weblogic_server 12.2.1.3.0
oracle weblogic_server 12.2.1.4.0
oracle weblogic_server 14.1.1.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:log4j:1.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "2954BDA9-F03D-44AC-A9EA-3E89036EEFA8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*",
                     matchCriteriaId: "80E516C0-98A4-4ADE-B69F-66A772E2BAAA",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1BAF877F-B8D5-4313-AC5C-26BB82006B30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_quarkus:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F039C746-2001-4EE5-835F-49607A94F12B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C4404A-CFB7-4B47-9487-F998825C31CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*",
                     matchCriteriaId: "A58966CB-36AF-4E64-AB39-BE3A0753E155",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq_streaming:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "8C7257E5-B4A7-4299-8FE1-A94121E47528",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "5CDDAFDB-E67A-4795-B2C4-C2D31734ABC8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "88BF3B2C-B121-483A-AEF2-8082F6DA5310",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3B78438D-1321-4BF4-AEB1-DAF60D589530",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C077D692-150C-4AE9-8C0B-7A3EA5EB1100",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_web_server:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "54EB07A0-FB38-4F17-9C8D-DB629967F07B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "6B62E762-2878-455A-93C9-A5DB430D7BB5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:*",
                     matchCriteriaId: "14CF53D2-B585-4EA5-8F18-21BC9ECBB4B6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform:4.8:*:*:*:*:*:*:*",
                     matchCriteriaId: "91B493F0-5542-49F7-AAAE-E6CA6E468D7B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "749804DA-4B27-492A-9ABA-6BB562A6B3AC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "A62E2A25-1AD7-4B4B-9D1B-F0DEA4550557",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "0331158C-BBE0-42DB-8180-EB1FCD290567",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "B602F9E8-1580-436C-A26D-6E6F8121A583",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "77C3DD16-1D81-40E1-B312-50FBD275507C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "81DAC8C0-D342-44B5-9432-6B88D389584F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E869C417-C0E6-4FC3-B406-45598A1D1906",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DFEFE2C0-7B98-44F9-B3AD-D6EC607E90DA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "C68536CA-C7E2-4228-A6B8-F0DB6A9D29EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "E1214FDF-357A-4BB9-BADE-50FB2BD16D10",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "B21E6EEF-2AB7-4E96-B092-1F49D11B4175",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "28CDCE04-B074-4D7A-B6E4-48193458C9A0",
                     versionEndExcluding: "12.0.0.4.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "5933FEA2-B79E-4EE7-B821-54D676B45734",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "0D299528-8EF0-49AF-9BDE-4B6C6B1DA36C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "17A91FD9-9F77-42D3-A4D9-48BC7568ADE1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "A7637F8B-15F1-42E2-BE18-E1FF7C66587D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "E43D793A-7756-4D58-A8ED-72DC4EC9CEA7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "6ED0EE39-C080-4E75-AE0F-3859B57EF851",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6E8758C8-87D3-450A-878B-86CE8C9FC140",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "054B56E0-F11B-4939-B7E1-E722C67A041A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "250A493C-E052-4978-ABBE-786DC8038448",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "2E2B771B-230A-4811-94D7-065C2722E428",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:fusion_middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F17531CB-DE8A-4ACD-93A0-6A5A8481D51B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:goldengate:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "507E7AEE-C2FC-4EED-B0F7-5E41642C0BF7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "66C673C4-A825-46C0-816B-103E1C058D03",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E8E7FBA9-0FFF-4C86-B151-28C17A142E0B",
                     versionEndExcluding: "11.2.8.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "55BBCD48-BCC6-4E19-A4CE-970E524B9FF4",
                     versionEndExcluding: "11.2.8.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1489DDA7-EDBE-404C-B48D-F0B52B741708",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "535BC19C-21A1-48E3-8CC0-B276BA5D494E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "228DA523-4D6D-48C5-BDB0-DB1A60F23F8B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B0EBAC6D-D0CE-42A1-AEA0-2D50C8035747",
                     versionEndIncluding: "8.0.29",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:retail_allocation:14.1.3.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "51E83F05-B691-4450-BCA9-32209AEC4F6A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:retail_allocation:15.0.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "288235F9-2F9E-469A-BE14-9089D0782875",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:retail_allocation:16.0.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "6672F9C1-DA04-47F1-B699-C171511ACE38",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:retail_allocation:19.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "11E57939-A543-44F7-942A-88690E39EABA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "30501D23-5044-477A-8DC3-7610126AEFD7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:stream_analytics:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "0B45A731-11D1-433B-B202-9C8D67C609F9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:timesten_grid:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "900D9DBF-8071-4CE5-A67A-9E0C00D04B87",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "EB7D0A30-3986-49AB-B7F3-DAE0024504BA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "A3ED272C-A545-4F8C-86C0-2736B3F2DCAF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.2.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5B4C338-11E1-4235-9D5A-960B2711AC39",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:utilities_testing_accelerator:6.0.0.3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "8C93F84E-9680-44EF-8656-D27440B51698",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F14A818F-AA16-4438-A3E4-E64C9287AC66",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "04BCDC24-4A21-473C-8733-0D9CFB38A752",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.",
      },
      {
         lang: "es",
         value: "JMSAppender en Log4j versión 1.2 es vulnerable a una deserialización de datos no confiables cuando el atacante presenta acceso de escritura a la configuración de Log4j. El atacante puede proporcionar configuraciones TopicBindingName y TopicConnectionFactoryBindingName haciendo que JMSAppender realice peticiones JNDI que resulten en la ejecución de código remota de forma similar a CVE-2021-44228. Tenga en cuenta que este problema sólo afecta a Log4j versión 1.2 cuando es configurado específicamente para usar JMSAppender, que no es el predeterminado. Apache Log4j versión 1.2 llegó al final de su vida útil en agosto de 2015. Los usuarios deberían actualizar a Log4j 2 ya que aborda otros numerosos problemas de las versiones anteriores",
      },
   ],
   id: "CVE-2021-4104",
   lastModified: "2024-11-21T06:36:54.560",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 6.8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.6,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-12-14T12:15:12.200",
   references: [
      {
         source: "security@apache.org",
         url: "http://www.openwall.com/lists/oss-security/2022/01/18/3",
      },
      {
         source: "security@apache.org",
         url: "https://access.redhat.com/security/cve/CVE-2021-4104",
      },
      {
         source: "security@apache.org",
         url: "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
      },
      {
         source: "security@apache.org",
         url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033",
      },
      {
         source: "security@apache.org",
         url: "https://security.gentoo.org/glsa/202209-02",
      },
      {
         source: "security@apache.org",
         url: "https://security.gentoo.org/glsa/202310-16",
      },
      {
         source: "security@apache.org",
         url: "https://security.gentoo.org/glsa/202312-02",
      },
      {
         source: "security@apache.org",
         url: "https://security.gentoo.org/glsa/202312-04",
      },
      {
         source: "security@apache.org",
         url: "https://security.netapp.com/advisory/ntap-20211223-0007/",
      },
      {
         source: "security@apache.org",
         url: "https://www.cve.org/CVERecord?id=CVE-2021-44228",
      },
      {
         source: "security@apache.org",
         url: "https://www.kb.cert.org/vuls/id/930724",
      },
      {
         source: "security@apache.org",
         url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
      },
      {
         source: "security@apache.org",
         url: "https://www.oracle.com/security-alerts/cpujan2022.html",
      },
      {
         source: "security@apache.org",
         url: "https://www.oracle.com/security-alerts/cpujul2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.openwall.com/lists/oss-security/2022/01/18/3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://access.redhat.com/security/cve/CVE-2021-4104",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://github.com/apache/logging-log4j2/pull/608#issuecomment-990494126",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0033",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.gentoo.org/glsa/202209-02",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.gentoo.org/glsa/202310-16",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.gentoo.org/glsa/202312-02",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.gentoo.org/glsa/202312-04",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20211223-0007/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.cve.org/CVERecord?id=CVE-2021-44228",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.kb.cert.org/vuls/id/930724",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujan2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujul2022.html",
      },
   ],
   sourceIdentifier: "security@apache.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "security@apache.org",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-11-09 17:29
Modified
2025-04-20 01:37
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
References
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2500.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2501.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2502.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2514.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2516.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2517.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2521.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2522.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2524.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2670.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-2671.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-0040.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2016-1773.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
secalert@redhat.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
secalert@redhat.comhttp://www.securityfocus.com/bid/78215Third Party Advisory, VDB Entry
secalert@redhat.comhttp://www.securitytracker.com/id/1034097Third Party Advisory, VDB Entry
secalert@redhat.comhttp://www.securitytracker.com/id/1037052Third Party Advisory, VDB Entry
secalert@redhat.comhttp://www.securitytracker.com/id/1037053Third Party Advisory, VDB Entry
secalert@redhat.comhttp://www.securitytracker.com/id/1037640Third Party Advisory, VDB Entry
secalert@redhat.comhttps://access.redhat.com/security/vulnerabilities/2059393Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/solutions/2045023Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1279330Issue Tracking, Third Party Advisory, VDB Entry, Vendor Advisory
secalert@redhat.comhttps://rhn.redhat.com/errata/RHSA-2015-2536.html
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20240216-0010/
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpujul2020.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2500.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2501.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2502.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2514.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2516.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2517.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2521.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2522.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2524.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2670.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-2671.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0040.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-1773.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
af854a3a-2127-422b-91ae-364da2661108http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/78215Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1034097Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037052Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037053Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1037640Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/vulnerabilities/2059393Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/solutions/2045023Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1279330Issue Tracking, Third Party Advisory, VDB Entry, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://rhn.redhat.com/errata/RHSA-2015-2536.html
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240216-0010/
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujul2020.html
Impacted products
Vendor Product Version
redhat data_grid 6.0.0
redhat jboss_a-mq 6.0.0
redhat jboss_bpm_suite 6.0.0
redhat jboss_data_virtualization 5.0.0
redhat jboss_data_virtualization 6.0.0
redhat jboss_enterprise_application_platform 4.3.0
redhat jboss_enterprise_application_platform 5.0.0
redhat jboss_enterprise_application_platform 6.0.0
redhat jboss_enterprise_brms_platform 5.0.0
redhat jboss_enterprise_brms_platform 6.0.0
redhat jboss_enterprise_soa_platform 5.0.0
redhat jboss_enterprise_web_server 3.0.0
redhat jboss_fuse 6.0.0
redhat jboss_fuse_service_works 6.0
redhat jboss_operations_network 3.0
redhat jboss_portal 6.0.0
redhat openshift 3.0
redhat subscription_asset_manager 1.3.0
redhat xpaas 3.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:data_grid:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D90858CA-996D-4A07-A57A-5E228BBED442",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C4404A-CFB7-4B47-9487-F998825C31CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7750C45E-4D02-45D5-A3AA-CF024C20AC8D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_virtualization:5.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3257F51A-C847-4251-8B1B-D8DEF11677A3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "5CDDAFDB-E67A-4795-B2C4-C2D31734ABC8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:4.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E82B2AD8-967D-4ABE-982B-87B9DE73F8D6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F5D7F1AD-4BD3-4C37-B6B5-B287464B2EEB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9CDC2527-97FE-409D-8DD6-78E085CC73C2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "FA0930C5-C483-414C-879D-029FDE8251C6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_soa_platform:5.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DFB8FED0-E0C6-409C-A2D8-B3999265D545",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8E2F2F98-DB90-43F6-8F28-3656207B6188",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse_service_works:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3B78438D-1321-4BF4-AEB1-DAF60D589530",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C077D692-150C-4AE9-8C0B-7A3EA5EB1100",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_portal:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E5C01A82-F078-4D08-93D0-6318272D3D8F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift:3.0:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "45690263-84D9-45A1-8C30-3ED2F0F11F47",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:subscription_asset_manager:1.3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6047BC2A-5EDB-458F-BBDB-38C0C3CF4E7C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:xpaas:3.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F58B1F3C-C27D-4387-9164-C3E2E0960A2A",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.",
      },
      {
         lang: "es",
         value: "Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x y 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x y 5.x; Enterprise Application Platform 6.x, 5.x y 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x y Red Hat Subscription Asset Manager 1.3 permiten que atacantes remotos ejecuten comandos arbitrarios mediante un objeto Java serializado manipulado. Esto está relacionado con la librería ACC (Apache Commons Collections).",
      },
   ],
   id: "CVE-2015-7501",
   lastModified: "2025-04-20T01:37:25.860",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 10,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-11-09T17:29:00.203",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2500.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2501.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2502.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2514.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2516.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2517.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2521.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2522.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2524.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2670.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2671.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2016-0040.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2016-1773.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/78215",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1034097",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1037052",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1037053",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1037640",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/vulnerabilities/2059393",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/solutions/2045023",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
            "VDB Entry",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
      },
      {
         source: "secalert@redhat.com",
         url: "https://rhn.redhat.com/errata/RHSA-2015-2536.html",
      },
      {
         source: "secalert@redhat.com",
         url: "https://security.netapp.com/advisory/ntap-20240216-0010/",
      },
      {
         source: "secalert@redhat.com",
         url: "https://www.oracle.com/security-alerts/cpujul2020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2500.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2501.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2502.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2514.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2516.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2517.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2521.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2522.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2524.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2670.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-2671.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2016-0040.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2016-1773.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/78215",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1034097",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1037052",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1037053",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1037640",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/vulnerabilities/2059393",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/solutions/2045023",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
            "VDB Entry",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1279330",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://rhn.redhat.com/errata/RHSA-2015-2536.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20240216-0010/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://www.oracle.com/security-alerts/cpujul2020.html",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-10-10 14:15
Modified
2025-04-12 01:00
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/10/6Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/10/7Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/13/4Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/13/9Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/18/4Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/18/8Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/19/6Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2023/10/20/8Mailing List, Third Party Advisory
cve@mitre.orghttps://access.redhat.com/security/cve/cve-2023-44487Vendor Advisory
cve@mitre.orghttps://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/Press/Media Coverage, Third Party Advisory
cve@mitre.orghttps://aws.amazon.com/security/security-bulletins/AWS-2023-011/Third Party Advisory
cve@mitre.orghttps://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/Technical Description, Vendor Advisory
cve@mitre.orghttps://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/Third Party Advisory, Vendor Advisory
cve@mitre.orghttps://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/Vendor Advisory
cve@mitre.orghttps://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attackPress/Media Coverage, Third Party Advisory
cve@mitre.orghttps://blog.vespa.ai/cve-2023-44487/Vendor Advisory
cve@mitre.orghttps://bugzilla.proxmox.com/show_bug.cgi?id=4988Issue Tracking, Third Party Advisory
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=2242803Issue Tracking, Vendor Advisory
cve@mitre.orghttps://bugzilla.suse.com/show_bug.cgi?id=1216123Issue Tracking, Vendor Advisory
cve@mitre.orghttps://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9Mailing List, Patch, Vendor Advisory
cve@mitre.orghttps://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/Technical Description, Vendor Advisory
cve@mitre.orghttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attackTechnical Description, Vendor Advisory
cve@mitre.orghttps://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125Vendor Advisory
cve@mitre.orghttps://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715Third Party Advisory
cve@mitre.orghttps://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cveTechnical Description, Third Party Advisory
cve@mitre.orghttps://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764Vendor Advisory
cve@mitre.orghttps://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088Issue Tracking, Patch
cve@mitre.orghttps://github.com/Azure/AKS/issues/3947Issue Tracking
cve@mitre.orghttps://github.com/Kong/kong/discussions/11741Issue Tracking
cve@mitre.orghttps://github.com/advisories/GHSA-qppj-fm5r-hxr3Vendor Advisory
cve@mitre.orghttps://github.com/advisories/GHSA-vx74-f528-fxqgMitigation, Patch, Vendor Advisory
cve@mitre.orghttps://github.com/advisories/GHSA-xpw8-rcwv-8f8pPatch, Vendor Advisory
cve@mitre.orghttps://github.com/akka/akka-http/issues/4323Issue Tracking
cve@mitre.orghttps://github.com/alibaba/tengine/issues/1872Issue Tracking
cve@mitre.orghttps://github.com/apache/apisix/issues/10320Issue Tracking
cve@mitre.orghttps://github.com/apache/httpd-site/pull/10Issue Tracking
cve@mitre.orghttps://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113Product
cve@mitre.orghttps://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2Product, Third Party Advisory
cve@mitre.orghttps://github.com/apache/trafficserver/pull/10564Issue Tracking, Patch
cve@mitre.orghttps://github.com/arkrwn/PoC/tree/main/CVE-2023-44487Vendor Advisory
cve@mitre.orghttps://github.com/bcdannyboy/CVE-2023-44487Third Party Advisory
cve@mitre.orghttps://github.com/caddyserver/caddy/issues/5877Issue Tracking, Vendor Advisory
cve@mitre.orghttps://github.com/caddyserver/caddy/releases/tag/v2.7.5Release Notes, Third Party Advisory
cve@mitre.orghttps://github.com/dotnet/announcements/issues/277Issue Tracking, Mitigation, Vendor Advisory
cve@mitre.orghttps://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73Product, Release Notes
cve@mitre.orghttps://github.com/eclipse/jetty.project/issues/10679Issue Tracking
cve@mitre.orghttps://github.com/envoyproxy/envoy/pull/30055Issue Tracking, Patch
cve@mitre.orghttps://github.com/etcd-io/etcd/issues/16740Issue Tracking, Patch
cve@mitre.orghttps://github.com/facebook/proxygen/pull/466Issue Tracking, Patch
cve@mitre.orghttps://github.com/golang/go/issues/63417Issue Tracking
cve@mitre.orghttps://github.com/grpc/grpc-go/pull/6703Issue Tracking, Patch
cve@mitre.orghttps://github.com/grpc/grpc/releases/tag/v1.59.2Mailing List
cve@mitre.orghttps://github.com/h2o/h2o/pull/3291Issue Tracking, Patch
cve@mitre.orghttps://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqfVendor Advisory
cve@mitre.orghttps://github.com/haproxy/haproxy/issues/2312Issue Tracking
cve@mitre.orghttps://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244Product
cve@mitre.orghttps://github.com/junkurihara/rust-rpxy/issues/97Issue Tracking
cve@mitre.orghttps://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1Patch
cve@mitre.orghttps://github.com/kazu-yamamoto/http2/issues/93Issue Tracking
cve@mitre.orghttps://github.com/kubernetes/kubernetes/pull/121120Issue Tracking, Patch
cve@mitre.orghttps://github.com/line/armeria/pull/5232Issue Tracking, Patch
cve@mitre.orghttps://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632Patch
cve@mitre.orghttps://github.com/micrictor/http2-rst-streamExploit, Third Party Advisory
cve@mitre.orghttps://github.com/microsoft/CBL-Mariner/pull/6381Issue Tracking, Patch
cve@mitre.orghttps://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61Patch
cve@mitre.orghttps://github.com/nghttp2/nghttp2/pull/1961Issue Tracking, Patch
cve@mitre.orghttps://github.com/nghttp2/nghttp2/releases/tag/v1.57.0Release Notes
cve@mitre.orghttps://github.com/ninenines/cowboy/issues/1615Issue Tracking
cve@mitre.orghttps://github.com/nodejs/node/pull/50121Issue Tracking
cve@mitre.orghttps://github.com/openresty/openresty/issues/930Issue Tracking
cve@mitre.orghttps://github.com/opensearch-project/data-prepper/issues/3474Issue Tracking, Patch
cve@mitre.orghttps://github.com/oqtane/oqtane.framework/discussions/3367Issue Tracking
cve@mitre.orghttps://github.com/projectcontour/contour/pull/5826Issue Tracking, Patch
cve@mitre.orghttps://github.com/tempesta-tech/tempesta/issues/1986Issue Tracking
cve@mitre.orghttps://github.com/varnishcache/varnish-cache/issues/3996Issue Tracking
cve@mitre.orghttps://groups.google.com/g/golang-announce/c/iNNxDTCjZvoMailing List, Release Notes, Vendor Advisory
cve@mitre.orghttps://istio.io/latest/news/security/istio-security-2023-004/Vendor Advisory
cve@mitre.orghttps://linkerd.io/2023/10/12/linkerd-cve-2023-44487/Vendor Advisory
cve@mitre.orghttps://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87qMailing List
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00023.htmlMailing List
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00024.htmlMailing List
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00045.htmlMailing List
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/10/msg00047.htmlMailing List
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/11/msg00001.htmlMailing List
cve@mitre.orghttps://lists.debian.org/debian-lts-announce/2023/11/msg00012.htmlMailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/Mailing List
cve@mitre.orghttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/Mailing List
cve@mitre.orghttps://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.htmlMailing List, Third Party Advisory
cve@mitre.orghttps://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.htmlMailing List, Patch, Third Party Advisory
cve@mitre.orghttps://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.htmlThird Party Advisory
cve@mitre.orghttps://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/Patch, Vendor Advisory
cve@mitre.orghttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487Mitigation, Patch, Vendor Advisory
cve@mitre.orghttps://my.f5.com/manage/s/article/K000137106Vendor Advisory
cve@mitre.orghttps://netty.io/news/2023/10/10/4-1-100-Final.htmlRelease Notes, Vendor Advisory
cve@mitre.orghttps://news.ycombinator.com/item?id=37830987Issue Tracking
cve@mitre.orghttps://news.ycombinator.com/item?id=37830998Issue Tracking, Press/Media Coverage
cve@mitre.orghttps://news.ycombinator.com/item?id=37831062Issue Tracking
cve@mitre.orghttps://news.ycombinator.com/item?id=37837043Issue Tracking
cve@mitre.orghttps://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/Third Party Advisory
cve@mitre.orghttps://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffectedThird Party Advisory
cve@mitre.orghttps://security.gentoo.org/glsa/202311-09Third Party Advisory
cve@mitre.orghttps://security.netapp.com/advisory/ntap-20231016-0001/Third Party Advisory
cve@mitre.orghttps://security.netapp.com/advisory/ntap-20240426-0007/Third Party Advisory
cve@mitre.orghttps://security.netapp.com/advisory/ntap-20240621-0006/Exploit, Third Party Advisory
cve@mitre.orghttps://security.netapp.com/advisory/ntap-20240621-0007/Third Party Advisory
cve@mitre.orghttps://security.paloaltonetworks.com/CVE-2023-44487Vendor Advisory
cve@mitre.orghttps://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14Release Notes
cve@mitre.orghttps://ubuntu.com/security/CVE-2023-44487Vendor Advisory
cve@mitre.orghttps://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/Third Party Advisory
cve@mitre.orghttps://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487Third Party Advisory, US Government Resource
cve@mitre.orghttps://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-eventPress/Media Coverage, Third Party Advisory
cve@mitre.orghttps://www.debian.org/security/2023/dsa-5521Mailing List, Vendor Advisory
cve@mitre.orghttps://www.debian.org/security/2023/dsa-5522Mailing List, Vendor Advisory
cve@mitre.orghttps://www.debian.org/security/2023/dsa-5540Mailing List, Third Party Advisory
cve@mitre.orghttps://www.debian.org/security/2023/dsa-5549Mailing List, Third Party Advisory
cve@mitre.orghttps://www.debian.org/security/2023/dsa-5558Mailing List, Third Party Advisory
cve@mitre.orghttps://www.debian.org/security/2023/dsa-5570Third Party Advisory
cve@mitre.orghttps://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487Third Party Advisory, Vendor Advisory
cve@mitre.orghttps://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/Vendor Advisory
cve@mitre.orghttps://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/Mitigation, Vendor Advisory
cve@mitre.orghttps://www.openwall.com/lists/oss-security/2023/10/10/6Mailing List, Third Party Advisory
cve@mitre.orghttps://www.phoronix.com/news/HTTP2-Rapid-Reset-AttackPress/Media Coverage
cve@mitre.orghttps://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/Press/Media Coverage, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/13/4Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/13/9Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/18/4Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/18/8Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/19/6Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/10/20/8Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/cve-2023-44487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/Press/Media Coverage, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://aws.amazon.com/security/security-bulletins/AWS-2023-011/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/Technical Description, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/Third Party Advisory, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attackPress/Media Coverage, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.vespa.ai/cve-2023-44487/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.proxmox.com/show_bug.cgi?id=4988Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2242803Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.suse.com/show_bug.cgi?id=1216123Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9Mailing List, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/Technical Description, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attackTechnical Description, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cveTechnical Description, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/Azure/AKS/issues/3947Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/Kong/kong/discussions/11741Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/advisories/GHSA-qppj-fm5r-hxr3Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/advisories/GHSA-vx74-f528-fxqgMitigation, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/advisories/GHSA-xpw8-rcwv-8f8pPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/akka/akka-http/issues/4323Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/alibaba/tengine/issues/1872Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/apisix/issues/10320Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/httpd-site/pull/10Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113Product
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2Product, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/trafficserver/pull/10564Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/bcdannyboy/CVE-2023-44487Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/caddyserver/caddy/issues/5877Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/caddyserver/caddy/releases/tag/v2.7.5Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/dotnet/announcements/issues/277Issue Tracking, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73Product, Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/eclipse/jetty.project/issues/10679Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/envoyproxy/envoy/pull/30055Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/etcd-io/etcd/issues/16740Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/facebook/proxygen/pull/466Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/golang/go/issues/63417Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/grpc/grpc-go/pull/6703Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/h2o/h2o/pull/3291Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqfVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/haproxy/haproxy/issues/2312Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244Product
af854a3a-2127-422b-91ae-364da2661108https://github.com/junkurihara/rust-rpxy/issues/97Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/kazu-yamamoto/http2/issues/93Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/kubernetes/kubernetes/pull/121120Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/line/armeria/pull/5232Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/micrictor/http2-rst-streamExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/microsoft/CBL-Mariner/pull/6381Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/nghttp2/nghttp2/pull/1961Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0Release Notes
af854a3a-2127-422b-91ae-364da2661108https://github.com/ninenines/cowboy/issues/1615Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/nodejs/node/pull/50121Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/openresty/openresty/issues/930Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/opensearch-project/data-prepper/issues/3474Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/oqtane/oqtane.framework/discussions/3367Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/projectcontour/contour/pull/5826Issue Tracking, Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/tempesta-tech/tempesta/issues/1986Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://github.com/varnishcache/varnish-cache/issues/3996Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://groups.google.com/g/golang-announce/c/iNNxDTCjZvoMailing List, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://istio.io/latest/news/security/istio-security-2023-004/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87qMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/10/msg00020.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/10/msg00023.htmlMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/10/msg00024.htmlMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/10/msg00045.htmlMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/10/msg00047.htmlMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/11/msg00001.htmlMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/11/msg00012.htmlMailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/Mailing List
af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.htmlMailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487Mitigation, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://my.f5.com/manage/s/article/K000137106Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://netty.io/news/2023/10/10/4-1-100-Final.htmlRelease Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=37830987Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=37830998Issue Tracking, Press/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=37831062Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://news.ycombinator.com/item?id=37837043Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffectedThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202311-09Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20231016-0001/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240426-0007/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0006/Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0007/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.paloaltonetworks.com/CVE-2023-44487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14Release Notes
af854a3a-2127-422b-91ae-364da2661108https://ubuntu.com/security/CVE-2023-44487Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-eventPress/Media Coverage, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5521Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5522Mailing List, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5540Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5549Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5558Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5570Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487Third Party Advisory, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.openwall.com/lists/oss-security/2023/10/10/6Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.phoronix.com/news/HTTP2-Rapid-Reset-AttackPress/Media Coverage
af854a3a-2127-422b-91ae-364da2661108https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/Press/Media Coverage, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-causeThird Party Advisory
Impacted products
Vendor Product Version
ietf http 2.0
nghttp2 nghttp2 *
netty netty *
envoyproxy envoy 1.24.10
envoyproxy envoy 1.25.9
envoyproxy envoy 1.26.4
envoyproxy envoy 1.27.0
eclipse jetty *
eclipse jetty *
eclipse jetty *
eclipse jetty *
caddyserver caddy *
golang go *
golang go *
golang http2 *
golang networking *
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager *
f5 big-ip_access_policy_manager 17.1.0
f5 big-ip_advanced_firewall_manager *
f5 big-ip_advanced_firewall_manager *
f5 big-ip_advanced_firewall_manager *
f5 big-ip_advanced_firewall_manager *
f5 big-ip_advanced_firewall_manager 17.1.0
f5 big-ip_advanced_web_application_firewall *
f5 big-ip_advanced_web_application_firewall *
f5 big-ip_advanced_web_application_firewall *
f5 big-ip_advanced_web_application_firewall *
f5 big-ip_advanced_web_application_firewall 17.1.0
f5 big-ip_analytics *
f5 big-ip_analytics *
f5 big-ip_analytics *
f5 big-ip_analytics *
f5 big-ip_analytics 17.1.0
f5 big-ip_application_acceleration_manager *
f5 big-ip_application_acceleration_manager *
f5 big-ip_application_acceleration_manager *
f5 big-ip_application_acceleration_manager *
f5 big-ip_application_acceleration_manager 17.1.0
f5 big-ip_application_security_manager *
f5 big-ip_application_security_manager *
f5 big-ip_application_security_manager *
f5 big-ip_application_security_manager *
f5 big-ip_application_security_manager 17.1.0
f5 big-ip_application_visibility_and_reporting *
f5 big-ip_application_visibility_and_reporting *
f5 big-ip_application_visibility_and_reporting *
f5 big-ip_application_visibility_and_reporting *
f5 big-ip_application_visibility_and_reporting 17.1.0
f5 big-ip_carrier-grade_nat *
f5 big-ip_carrier-grade_nat *
f5 big-ip_carrier-grade_nat *
f5 big-ip_carrier-grade_nat *
f5 big-ip_carrier-grade_nat 17.1.0
f5 big-ip_ddos_hybrid_defender *
f5 big-ip_ddos_hybrid_defender *
f5 big-ip_ddos_hybrid_defender *
f5 big-ip_ddos_hybrid_defender *
f5 big-ip_ddos_hybrid_defender 17.1.0
f5 big-ip_domain_name_system *
f5 big-ip_domain_name_system *
f5 big-ip_domain_name_system *
f5 big-ip_domain_name_system *
f5 big-ip_domain_name_system 17.1.0
f5 big-ip_fraud_protection_service *
f5 big-ip_fraud_protection_service *
f5 big-ip_fraud_protection_service *
f5 big-ip_fraud_protection_service *
f5 big-ip_fraud_protection_service 17.1.0
f5 big-ip_global_traffic_manager *
f5 big-ip_global_traffic_manager *
f5 big-ip_global_traffic_manager *
f5 big-ip_global_traffic_manager *
f5 big-ip_global_traffic_manager 17.1.0
f5 big-ip_link_controller *
f5 big-ip_link_controller *
f5 big-ip_link_controller *
f5 big-ip_link_controller *
f5 big-ip_link_controller 17.1.0
f5 big-ip_local_traffic_manager *
f5 big-ip_local_traffic_manager *
f5 big-ip_local_traffic_manager *
f5 big-ip_local_traffic_manager *
f5 big-ip_local_traffic_manager 17.1.0
f5 big-ip_next 20.0.1
f5 big-ip_next_service_proxy_for_kubernetes *
f5 big-ip_policy_enforcement_manager *
f5 big-ip_policy_enforcement_manager *
f5 big-ip_policy_enforcement_manager *
f5 big-ip_policy_enforcement_manager *
f5 big-ip_policy_enforcement_manager 17.1.0
f5 big-ip_ssl_orchestrator *
f5 big-ip_ssl_orchestrator *
f5 big-ip_ssl_orchestrator *
f5 big-ip_ssl_orchestrator *
f5 big-ip_ssl_orchestrator 17.1.0
f5 big-ip_webaccelerator *
f5 big-ip_webaccelerator *
f5 big-ip_webaccelerator *
f5 big-ip_webaccelerator *
f5 big-ip_webaccelerator 17.1.0
f5 big-ip_websafe *
f5 big-ip_websafe *
f5 big-ip_websafe *
f5 big-ip_websafe *
f5 big-ip_websafe 17.1.0
f5 nginx *
f5 nginx_ingress_controller *
f5 nginx_ingress_controller *
f5 nginx_plus *
f5 nginx_plus r29
f5 nginx_plus r30
apache tomcat *
apache tomcat *
apache tomcat *
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apache tomcat 11.0.0
apple swiftnio_http\/2 *
grpc grpc *
grpc grpc *
grpc grpc *
grpc grpc 1.57.0
microsoft .net *
microsoft .net *
microsoft asp.net_core *
microsoft asp.net_core *
microsoft azure_kubernetes_service *
microsoft visual_studio_2022 *
microsoft visual_studio_2022 *
microsoft visual_studio_2022 *
microsoft visual_studio_2022 *
microsoft windows_10_1607 *
microsoft windows_10_1607 *
microsoft windows_10_1809 *
microsoft windows_10_21h2 *
microsoft windows_10_22h2 *
microsoft windows_11_21h2 *
microsoft windows_11_22h2 *
microsoft windows_server_2016 -
microsoft windows_server_2019 -
microsoft windows_server_2022 -
nodejs node.js *
nodejs node.js *
microsoft cbl-mariner *
dena h2o *
facebook proxygen *
apache apisix *
apache traffic_server *
apache traffic_server *
amazon opensearch_data_prepper *
debian debian_linux 10.0
debian debian_linux 11.0
debian debian_linux 12.0
kazu-yamamoto http2 *
istio istio *
istio istio *
istio istio *
varnish_cache_project varnish_cache *
traefik traefik *
traefik traefik 3.0.0
traefik traefik 3.0.0
traefik traefik 3.0.0
projectcontour contour *
linkerd linkerd *
linkerd linkerd 2.13.0
linkerd linkerd 2.13.1
linkerd linkerd 2.14.0
linkerd linkerd 2.14.1
linecorp armeria *
redhat 3scale_api_management_platform 2.0
redhat advanced_cluster_management_for_kubernetes 2.0
redhat advanced_cluster_security 3.0
redhat advanced_cluster_security 4.0
redhat ansible_automation_platform 2.0
redhat build_of_optaplanner 8.0
redhat build_of_quarkus -
redhat ceph_storage 5.0
redhat cert-manager_operator_for_red_hat_openshift -
redhat certification_for_red_hat_enterprise_linux 8.0
redhat certification_for_red_hat_enterprise_linux 9.0
redhat cost_management -
redhat cryostat 2.0
redhat decision_manager 7.0
redhat fence_agents_remediation_operator -
redhat integration_camel_for_spring_boot -
redhat integration_camel_k -
redhat integration_service_registry -
redhat jboss_a-mq 7
redhat jboss_a-mq_streams -
redhat jboss_core_services -
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 6.0.0
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 6.0.0
redhat jboss_fuse 7.0.0
redhat logging_subsystem_for_red_hat_openshift -
redhat machine_deletion_remediation_operator -
redhat migration_toolkit_for_applications 6.0
redhat migration_toolkit_for_containers -
redhat migration_toolkit_for_virtualization -
redhat network_observability_operator -
redhat node_healthcheck_operator -
redhat node_maintenance_operator -
redhat openshift -
redhat openshift_api_for_data_protection -
redhat openshift_container_platform 4.0
redhat openshift_container_platform_assisted_installer -
redhat openshift_data_science -
redhat openshift_dev_spaces -
redhat openshift_developer_tools_and_services -
redhat openshift_distributed_tracing -
redhat openshift_gitops -
redhat openshift_pipelines -
redhat openshift_sandboxed_containers -
redhat openshift_secondary_scheduler_operator -
redhat openshift_serverless -
redhat openshift_service_mesh 2.0
redhat openshift_virtualization 4
redhat openstack_platform 16.1
redhat openstack_platform 16.2
redhat openstack_platform 17.1
redhat process_automation 7.0
redhat quay 3.0.0
redhat run_once_duration_override_operator -
redhat satellite 6.0
redhat self_node_remediation_operator -
redhat service_interconnect 1.0
redhat single_sign-on 7.0
redhat support_for_spring_boot -
redhat web_terminal -
redhat enterprise_linux 6.0
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat service_telemetry_framework 1.5
redhat enterprise_linux 8.0
fedoraproject fedora 37
fedoraproject fedora 38
netapp astra_control_center -
netapp oncommand_insight -
akka http_server *
konghq kong_gateway *
jenkins jenkins *
jenkins jenkins *
apache solr *
openresty openresty *
cisco connected_mobile_experiences *
cisco crosswork_data_gateway *
cisco crosswork_data_gateway 5.0
cisco crosswork_zero_touch_provisioning *
cisco data_center_network_manager -
cisco enterprise_chat_and_email -
cisco expressway *
cisco firepower_threat_defense *
cisco iot_field_network_director *
cisco prime_access_registrar *
cisco prime_cable_provisioning *
cisco prime_infrastructure *
cisco prime_network_registrar *
cisco secure_dynamic_attributes_connector *
cisco secure_malware_analytics *
cisco telepresence_video_communication_server *
cisco ultra_cloud_core_-_policy_control_function *
cisco ultra_cloud_core_-_policy_control_function 2024.01.0
cisco ultra_cloud_core_-_serving_gateway_function *
cisco ultra_cloud_core_-_session_management_function *
cisco unified_attendant_console_advanced -
cisco unified_contact_center_domain_manager -
cisco unified_contact_center_enterprise -
cisco unified_contact_center_enterprise_-_live_data_server *
cisco unified_contact_center_management_portal -
cisco fog_director *
cisco ios_xe *
cisco ios_xr *
cisco secure_web_appliance_firmware *
cisco secure_web_appliance -
cisco nx-os *
cisco nx-os *
cisco nexus_3016 -
cisco nexus_3016q -
cisco nexus_3048 -
cisco nexus_3064 -
cisco nexus_3064-32t -
cisco nexus_3064-t -
cisco nexus_3064-x -
cisco nexus_3064t -
cisco nexus_3064x -
cisco nexus_3100 -
cisco nexus_3100-v -
cisco nexus_3100-z -
cisco nexus_3100v -
cisco nexus_31108pc-v -
cisco nexus_31108pv-v -
cisco nexus_31108tc-v -
cisco nexus_31128pq -
cisco nexus_3132c-z -
cisco nexus_3132q -
cisco nexus_3132q-v -
cisco nexus_3132q-x -
cisco nexus_3132q-x\/3132q-xl -
cisco nexus_3132q-xl -
cisco nexus_3164q -
cisco nexus_3172 -
cisco nexus_3172pq -
cisco nexus_3172pq-xl -
cisco nexus_3172pq\/pq-xl -
cisco nexus_3172tq -
cisco nexus_3172tq-32t -
cisco nexus_3172tq-xl -
cisco nexus_3200 -
cisco nexus_3232 -
cisco nexus_3232c -
cisco nexus_3232c_ -
cisco nexus_3264c-e -
cisco nexus_3264q -
cisco nexus_3400 -
cisco nexus_3408-s -
cisco nexus_34180yc -
cisco nexus_34200yc-sm -
cisco nexus_3432d-s -
cisco nexus_3464c -
cisco nexus_3500 -
cisco nexus_3524 -
cisco nexus_3524-x -
cisco nexus_3524-x\/xl -
cisco nexus_3524-xl -
cisco nexus_3548 -
cisco nexus_3548-x -
cisco nexus_3548-x\/xl -
cisco nexus_3548-xl -
cisco nexus_3600 -
cisco nexus_36180yc-r -
cisco nexus_3636c-r -
cisco nx-os *
cisco nx-os *
cisco nexus_9000v -
cisco nexus_9200 -
cisco nexus_9200yc -
cisco nexus_92160yc-x -
cisco nexus_92160yc_switch -
cisco nexus_9221c -
cisco nexus_92300yc -
cisco nexus_92300yc_switch -
cisco nexus_92304qc -
cisco nexus_92304qc_switch -
cisco nexus_9232e -
cisco nexus_92348gc-x -
cisco nexus_9236c -
cisco nexus_9236c_switch -
cisco nexus_9272q -
cisco nexus_9272q_switch -
cisco nexus_9300 -
cisco nexus_93108tc-ex -
cisco nexus_93108tc-ex-24 -
cisco nexus_93108tc-ex_switch -
cisco nexus_93108tc-fx -
cisco nexus_93108tc-fx-24 -
cisco nexus_93108tc-fx3h -
cisco nexus_93108tc-fx3p -
cisco nexus_93120tx -
cisco nexus_93120tx_switch -
cisco nexus_93128 -
cisco nexus_93128tx -
cisco nexus_93128tx_switch -
cisco nexus_9316d-gx -
cisco nexus_93180lc-ex -
cisco nexus_93180lc-ex_switch -
cisco nexus_93180tc-ex -
cisco nexus_93180yc-ex -
cisco nexus_93180yc-ex-24 -
cisco nexus_93180yc-ex_switch -
cisco nexus_93180yc-fx -
cisco nexus_93180yc-fx-24 -
cisco nexus_93180yc-fx3 -
cisco nexus_93180yc-fx3h -
cisco nexus_93180yc-fx3s -
cisco nexus_93216tc-fx2 -
cisco nexus_93240tc-fx2 -
cisco nexus_93240yc-fx2 -
cisco nexus_9332c -
cisco nexus_9332d-gx2b -
cisco nexus_9332d-h2r -
cisco nexus_9332pq -
cisco nexus_9332pq_switch -
cisco nexus_93360yc-fx2 -
cisco nexus_9336c-fx2 -
cisco nexus_9336c-fx2-e -
cisco nexus_9336pq -
cisco nexus_9336pq_aci -
cisco nexus_9336pq_aci_spine -
cisco nexus_9336pq_aci_spine_switch -
cisco nexus_9348d-gx2a -
cisco nexus_9348gc-fx3 -
cisco nexus_9348gc-fxp -
cisco nexus_93600cd-gx -
cisco nexus_9364c -
cisco nexus_9364c-gx -
cisco nexus_9364d-gx2a -
cisco nexus_9372px -
cisco nexus_9372px-e -
cisco nexus_9372px-e_switch -
cisco nexus_9372px_switch -
cisco nexus_9372tx -
cisco nexus_9372tx-e -
cisco nexus_9372tx-e_switch -
cisco nexus_9372tx_switch -
cisco nexus_9396px -
cisco nexus_9396px_switch -
cisco nexus_9396tx -
cisco nexus_9396tx_switch -
cisco nexus_9408 -
cisco nexus_9432pq -
cisco nexus_9500 -
cisco nexus_9500_16-slot -
cisco nexus_9500_4-slot -
cisco nexus_9500_8-slot -
cisco nexus_9500_supervisor_a -
cisco nexus_9500_supervisor_a\+ -
cisco nexus_9500_supervisor_b -
cisco nexus_9500_supervisor_b\+ -
cisco nexus_9500r -
cisco nexus_9504 -
cisco nexus_9504_switch -
cisco nexus_9508 -
cisco nexus_9508_switch -
cisco nexus_9516 -
cisco nexus_9516_switch -
cisco nexus_9536pq -
cisco nexus_9636pq -
cisco nexus_9716d-gx -
cisco nexus_9736pq -
cisco nexus_9800 -
cisco nexus_9804 -
cisco nexus_9808 -


To clipboard 

{
   cisaActionDue: "2023-10-31",
   cisaExploitAdd: "2023-10-10",
   cisaRequiredAction: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
   cisaVulnerabilityName: "HTTP/2 Rapid Reset Attack Vulnerability",
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:ietf:http:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D5200E35-222B-42E0-83E0-5B702684D992",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C3BDC297-F023-4E87-8518-B84CCF9DD6A8",
                     versionEndExcluding: "1.57.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D12D5257-7ED2-400F-9EF7-40E0D3650C2B",
                     versionEndExcluding: "4.1.100",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:envoyproxy:envoy:1.24.10:*:*:*:*:*:*:*",
                     matchCriteriaId: "1B058776-B5B7-4079-B0AF-23F40926DCEC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:envoyproxy:envoy:1.25.9:*:*:*:*:*:*:*",
                     matchCriteriaId: "6D565975-EFD9-467C-B6E3-1866A4EF17A4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:envoyproxy:envoy:1.26.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6D487271-1B5E-4F16-B0CB-A7B8908935C6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:envoyproxy:envoy:1.27.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "BA6ED627-EFB3-4BDD-8ECC-C5947A1470B2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A4A6F189-6C43-462D-85C9-B0EBDA8A4683",
                     versionEndExcluding: "9.4.53",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C993C920-85C0-4181-A95E-5D965A670738",
                     versionEndExcluding: "10.0.17",
                     versionStartIncluding: "10.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "08E79A8E-E12C-498F-AF4F-1AAA7135661E",
                     versionEndExcluding: "11.0.17",
                     versionStartIncluding: "11.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F138D800-9A3B-4C76-8A3C-4793083A1517",
                     versionEndExcluding: "12.0.2",
                     versionStartIncluding: "12.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:caddyserver:caddy:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6341DDDA-AD27-4087-9D59-0A212F0037B4",
                     versionEndExcluding: "2.7.5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "328120E4-C031-44B4-9BE5-03B0CDAA066F",
                     versionEndExcluding: "1.20.10",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5FD9AB15-E5F6-4DBC-9EC7-D0ABA705802A",
                     versionEndExcluding: "1.21.3",
                     versionStartIncluding: "1.21.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:golang:http2:*:*:*:*:*:go:*:*",
                     matchCriteriaId: "D7D2F801-6F65-4705-BCB9-D057EA54A707",
                     versionEndExcluding: "0.17.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:golang:networking:*:*:*:*:*:go:*:*",
                     matchCriteriaId: "801F25DA-F38C-4452-8E90-235A3B1A5FF0",
                     versionEndExcluding: "0.17.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D93F04AD-DF14-48AB-9F13-8B2E491CF42E",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7522C760-7E07-406F-BF50-5656D5723C4F",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3A7F605E-EB10-40FB-98D6-7E3A95E310BC",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "783E62F2-F867-48F1-B123-D1227C970674",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_access_policy_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A8D90B7-A1AF-4EFB-B688-1563D81E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6603ED6A-3366-4572-AFCD-B3D4B1EC7606",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "88978E38-81D3-4EFE-8525-A300B101FA69",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0510296F-92D7-4388-AE3A-0D9799C2FC4D",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D7698D6C-B1F7-43C1-BBA6-88E956356B3D",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1A1CC91B-6920-4AF0-9EDD-DD3189E78F4D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "05E452AA-A520-4CBE-8767-147772B69194",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "596FC5D5-7329-4E39-841E-CAE937C02219",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B3C7A168-F370-441E-8790-73014BCEC39F",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CF16FD01-7704-40AB-ACB2-80A883804D22",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_advanced_web_application_firewall:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1769D69A-CB59-46B1-89B3-FB97DC6DEB9B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "9167FEC1-2C37-4946-9657-B4E69301FB24",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7B4B3442-E0C0-48CD-87AD-060E15C9801E",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8FA85EC1-D91A-49DD-949B-2AF7AC813CA5",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "20662BB0-4C3D-4CF0-B068-3555C65DD06C",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_analytics:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "59203EBF-C52A-45A1-B8DF-00E17E3EFB51",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7EC2324D-EC8B-41DF-88A7-819E53AAD0FC",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "9B88F9D1-B54B-40C7-A18A-26C4A071D7EC",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C8F39403-C259-4D6F-9E9A-53671017EEDB",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "220F2D38-FA82-45EF-B957-7678C9FEDBC1",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_acceleration_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "5C698C1C-A3DD-46E2-B05A-12F2604E7F85",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "922AA845-530A-4B4B-9976-4CBC30C8A324",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F938EB43-8373-47EB-B269-C6DF058A9244",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1771493E-ACAA-477F-8AB4-25DB12F6AD6E",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5E86F3D5-65A4-48CE-A6A2-736BBB88E3F8",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_security_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "87670A74-34FE-45DF-A725-25B804C845B3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C7E422F6-C4C2-43AC-B137-0997B5739030",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CC3F710F-DBCB-4976-9719-CF063DA22377",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B9B76A1-7C5A-453F-A4ED-F1A81BCEBEB5",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "88EDFCD9-775C-48FA-9CDA-2B04DA8D0612",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_application_visibility_and_reporting:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "67DB21AE-DF53-442D-B492-C4ED9A20B105",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4C9FCBCB-9CE0-49E7-85C8-69E71D211912",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "112DFA85-90AD-478D-BD70-8C7C0C074F1B",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "DB704A1C-D8B7-48BB-A15A-C14DB591FE4A",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_carrier-grade_nat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "21D51D9F-2840-4DEA-A007-D20111A1745C",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_carrier-grade_nat:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7BC1D037-74D2-4F92-89AD-C90F6CBF440B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "CAEF3EA4-7D5A-4B44-9CE3-258AEC745866",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FBCE2D1-9D93-415D-AB2C-2060307C305A",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8070B469-8CC4-4D2F-97D7-12D0ABB963C1",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A326597E-725D-45DE-BEF7-2ED92137B253",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ddos_hybrid_defender:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7B235A78-649B-46C5-B24B-AB485A884654",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "08B25AAB-A98C-4F89-9131-29E3A8C0ED23",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "ED9B976A-D3AD-4445-BF8A-067C3EBDFBB0",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "98D2CE1E-DED0-470A-AA78-C78EF769C38E",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C966FABA-7199-4F0D-AB8C-4590FE9D2FFF",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_domain_name_system:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "84D00768-E71B-4FF7-A7BF-F2C8CFBC900D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E3D2ABA3-D4A9-4267-B0DF-7C3BBEEAEB66",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BC36311E-BB00-4750-85C8-51F5A2604F07",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A65D357E-4B40-42EC-9AAA-2B6CEF78C401",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D7EF9865-FE65-4DFB-BF21-62FBCE65FF1C",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_fraud_protection_service:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "ABBD10E8-6054-408F-9687-B9BF6375CA09",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E6018B01-048C-43BB-A78D-66910ED60CA9",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3A6A5686-5A8B-45D5-9165-BC99D2CCAC47",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D2A121F-5BD2-4263-8ED3-1DDE25B5C306",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A4F7BAD-3EDD-4DE0-AAB7-DE5ACA34DD79",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_global_traffic_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "83794B04-87E2-4CA9-81F5-BB820D0F5395",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D9EC2237-117F-43BD-ADEC-516CF72E04EF",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F70D4B6F-65CF-48F4-9A07-072DFBCE53D9",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "29563719-1AF2-4BB8-8CCA-A0869F87795D",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D24815DD-579A-46D1-B9F2-3BB2C56BC54D",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_link_controller:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A6E7035-3299-474F-8F67-945EA9A059D0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0360F76D-E75E-4B05-A294-B47012323ED9",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7A4607BF-41AC-4E84-A110-74E085FF0445",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "441CC945-7CA3-49C0-AE10-94725301E31D",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "46BA8E8A-6ED5-4FB2-8BBC-586AA031085A",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_local_traffic_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "56FB92F7-FF1E-425D-A5AB-9D9FB0BB9450",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_next:20.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "969C4F14-F6D6-46D6-B348-FC1463877680",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_next_service_proxy_for_kubernetes:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "41AD5040-1250-45F5-AB63-63F333D49BCC",
                     versionEndIncluding: "1.8.2",
                     versionStartIncluding: "1.5.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8257AA59-C14D-4EC1-B22C-DFBB92CBC297",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "37DB32BB-F4BA-4FB5-94B1-55C3F06749CF",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FFF5007E-761C-4697-8D34-C064DF0ABE8D",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "910441D3-90EF-4375-B007-D51120A60AB2",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "667EB77B-DA13-4BA4-9371-EE3F3A109F38",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8A6F9699-A485-4614-8F38-5A556D31617E",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5A90F547-97A2-41EC-9FDF-25F869F0FA38",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E76E1B82-F1DC-4366-B388-DBDF16C586A0",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ssl_orchestrator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "660137F4-15A1-42D1-BBAC-99A1D5BB398B",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_ssl_orchestrator:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C446827A-1F71-4FAD-9422-580642D26AD1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1932D32D-0E4B-4BBD-816F-6D47AB2E2F04",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D47B7691-A95B-45C0-BAB4-27E047F3C379",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2CD1637D-0E42-4928-867A-BA0FDB6E8462",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3A599F90-F66B-4DF0-AD7D-D234F328BD59",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_webaccelerator:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3D1B2000-C3FE-4B4C-885A-A5076EB164E1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5326759A-AFB0-4A15-B4E9-3C9A2E5DB32A",
                     versionEndIncluding: "13.1.5",
                     versionStartIncluding: "13.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "57D92D05-C67D-437E-88F3-DCC3F6B0ED2F",
                     versionEndIncluding: "14.1.5",
                     versionStartIncluding: "14.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "ECCB8C30-861E-4E48-A5F5-30EE523C1FB6",
                     versionEndIncluding: "15.1.10",
                     versionStartIncluding: "15.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_websafe:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F5FEAD2A-3A58-432E-BEBB-6E3FDE24395F",
                     versionEndIncluding: "16.1.4",
                     versionStartIncluding: "16.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:big-ip_websafe:17.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8AB23AE6-245E-43D6-B832-933F8259F937",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1188B4A9-2684-413C-83D1-E91C75AE0FCF",
                     versionEndIncluding: "1.25.2",
                     versionStartIncluding: "1.9.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3337609D-5291-4A52-BC6A-6A8D4E60EB20",
                     versionEndIncluding: "2.4.2",
                     versionStartIncluding: "2.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6CF0ABD9-EB28-4966-8C31-EED7AFBF1527",
                     versionEndIncluding: "3.3.0",
                     versionStartIncluding: "3.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F291CB34-47A4-425A-A200-087CC295AEC8",
                     versionEndExcluding: "r29",
                     versionStartIncluding: "r25",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:nginx_plus:r29:-:*:*:*:*:*:*",
                     matchCriteriaId: "5892B558-EC3A-43FF-A1D5-B2D9F70796F0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:f5:nginx_plus:r30:-:*:*:*:*:*:*",
                     matchCriteriaId: "96BF2B19-52C7-4051-BA58-CAE6F912B72F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "ABD26B48-CC80-4FAE-BD3D-78DE4C80C92B",
                     versionEndIncluding: "8.5.93",
                     versionStartIncluding: "8.5.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F3EC20B6-B2AB-41F5-9BF9-D16C1FE67C34",
                     versionEndIncluding: "9.0.80",
                     versionStartIncluding: "9.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0765CC3D-AB1A-4147-8900-EF4C105321F2",
                     versionEndIncluding: "10.1.13",
                     versionStartIncluding: "10.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone1:*:*:*:*:*:*",
                     matchCriteriaId: "D1AA7FF6-E8E7-4BF6-983E-0A99B0183008",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone10:*:*:*:*:*:*",
                     matchCriteriaId: "57088BDD-A136-45EF-A8A1-2EBF79CEC2CE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone11:*:*:*:*:*:*",
                     matchCriteriaId: "B32D1D7A-A04F-444E-8F45-BB9A9E4B0199",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone2:*:*:*:*:*:*",
                     matchCriteriaId: "2AAD52CE-94F5-4F98-A027-9A7E68818CB6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone3:*:*:*:*:*:*",
                     matchCriteriaId: "F1F981F5-035A-4EDD-8A9F-481EE8BC7FF7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone4:*:*:*:*:*:*",
                     matchCriteriaId: "03A171AF-2EC8-4422-912C-547CDB58CAAA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone5:*:*:*:*:*:*",
                     matchCriteriaId: "538E68C4-0BA4-495F-AEF8-4EF6EE7963CF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone6:*:*:*:*:*:*",
                     matchCriteriaId: "49350A6E-5E1D-45B2-A874-3B8601B3ADCC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone7:*:*:*:*:*:*",
                     matchCriteriaId: "5F50942F-DF54-46C0-8371-9A476DD3EEA3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone8:*:*:*:*:*:*",
                     matchCriteriaId: "D12C2C95-B79F-4AA4-8CE3-99A3EE7991AB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:tomcat:11.0.0:milestone9:*:*:*:*:*:*",
                     matchCriteriaId: "98792138-DD56-42DF-9612-3BDC65EEC117",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apple:swiftnio_http\\/2:*:*:*:*:*:swift:*:*",
                     matchCriteriaId: "08190072-3880-4EF5-B642-BA053090D95B",
                     versionEndExcluding: "1.28.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*",
                     matchCriteriaId: "5F4CDEA9-CB47-4881-B096-DA896E2364F3",
                     versionEndExcluding: "1.56.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:grpc:grpc:*:*:*:*:*:-:*:*",
                     matchCriteriaId: "E65AF7BC-7DAE-408A-8485-FBED22815F75",
                     versionEndIncluding: "1.59.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:grpc:grpc:*:*:*:*:*:go:*:*",
                     matchCriteriaId: "DD868DDF-C889-4F36-B5E6-68B6D9EA48CC",
                     versionEndExcluding: "1.58.3",
                     versionStartIncluding: "1.58.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:grpc:grpc:1.57.0:-:*:*:*:go:*:*",
                     matchCriteriaId: "FBD991E2-DB5A-4AAD-95BA-4B5ACB811C96",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4496821E-BD55-4F31-AD9C-A3D66CBBD6BD",
                     versionEndExcluding: "6.0.23",
                     versionStartIncluding: "6.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:.net:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8DF7ECF6-178D-433C-AA21-BAE9EF248F37",
                     versionEndExcluding: "7.0.12",
                     versionStartIncluding: "7.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1C3418F4-B8BF-4666-BB39-C188AB01F45C",
                     versionEndExcluding: "6.0.23",
                     versionStartIncluding: "6.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:asp.net_core:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1278DD1C-EFA9-4316-AD32-24C1B1FB0CEA",
                     versionEndExcluding: "7.0.12",
                     versionStartIncluding: "7.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:azure_kubernetes_service:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3BDFB0FF-0F4A-4B7B-94E8-ED72A8106314",
                     versionEndExcluding: "2023-10-08",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "16A8F269-E07E-402F-BFD5-60F3988A5EAF",
                     versionEndExcluding: "17.2.20",
                     versionStartIncluding: "17.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C4B2B972-69E2-4D21-9A7C-B2AFF1D89EB8",
                     versionEndExcluding: "17.4.12",
                     versionStartIncluding: "17.4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "DA5834D4-F52F-41C0-AA11-C974FFEEA063",
                     versionEndExcluding: "17.6.8",
                     versionStartIncluding: "17.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2166106F-ACD6-4C7B-B0CC-977B83CC5F73",
                     versionEndExcluding: "17.7.5",
                     versionStartIncluding: "17.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
                     matchCriteriaId: "4CD49C41-6D90-47D3-AB4F-4A74169D3A8F",
                     versionEndExcluding: "10.0.14393.6351",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
                     matchCriteriaId: "BAEFEE13-9CD7-46A2-8AF6-0A33C79C05F1",
                     versionEndExcluding: "10.0.14393.6351",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E500D59C-6597-45E9-A57B-BE26C0C231D3",
                     versionEndExcluding: "10.0.17763.4974",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C9F9A643-90C6-489C-98A0-D2739CE72F86",
                     versionEndExcluding: "10.0.19044.3570",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1814619C-ED07-49E0-A50A-E28D824D43BC",
                     versionEndExcluding: "10.0.19045.3570",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "100A27D3-87B0-4E72-83F6-7605E3F35E63",
                     versionEndExcluding: "10.0.22000.2538",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C6A36795-0238-45C9-ABE6-3DCCF751915B",
                     versionEndExcluding: "10.0.22621.2428",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DB79EE26-FC32-417D-A49C-A1A63165A968",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "821614DD-37DD-44E2-A8A4-FE8D23A33C3C",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*",
                     matchCriteriaId: "C61F0294-5C7E-4DB2-8905-B85D0782F35F",
                     versionEndExcluding: "18.18.2",
                     versionStartIncluding: "18.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "69843DE4-4721-4F0A-A9B7-0F6DF5AAA388",
                     versionEndExcluding: "20.8.1",
                     versionStartIncluding: "20.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:microsoft:cbl-mariner:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B25279EF-C406-4133-99ED-0492703E0A4E",
                     versionEndExcluding: "2023-10-11",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "9FFFF84B-F35C-43DE-959A-A5D10C3AE9F5",
                     versionEndExcluding: "2023-10-10",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:facebook:proxygen:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "9DCE8C89-7C22-48CA-AF22-B34C8AA2CB8C",
                     versionEndExcluding: "2023.10.16.00",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:apisix:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "EDEB508E-0EBD-4450-9074-983DDF568AB4",
                     versionEndExcluding: "3.6.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "93A1A748-6C71-4191-8A16-A93E94E2CDE4",
                     versionEndExcluding: "8.1.9",
                     versionStartIncluding: "8.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E4BCAF6-B246-41EC-9EE1-24296BFC4F5A",
                     versionEndExcluding: "9.2.3",
                     versionStartIncluding: "9.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:amazon:opensearch_data_prepper:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F70360D-6214-46BA-AF82-6AB01E13E4E9",
                     versionEndExcluding: "2.5.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "FA6FEEC2-9F11-4643-8827-749718254FED",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "46D69DCC-AE4D-4EA5-861C-D60951444C6C",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:kazu-yamamoto:http2:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E2DA759E-1AF8-49D3-A3FC-1B426C13CA82",
                     versionEndExcluding: "4.2.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "28BE6F7B-AE66-4C8A-AAFA-F1262671E9BF",
                     versionEndExcluding: "1.17.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F0C8E760-C8D2-483A-BBD4-6A6D292A3874",
                     versionEndExcluding: "1.18.3",
                     versionStartIncluding: "1.18.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:istio:istio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5D0F78BB-6A05-4C97-A8DB-E731B6CC8CC7",
                     versionEndExcluding: "1.19.1",
                     versionStartIncluding: "1.19.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "050AE218-3871-44D6-94DA-12D84C2093CB",
                     versionEndExcluding: "2023-10-10",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B36BFFB0-C0EC-4926-A1DB-0B711C846A68",
                     versionEndExcluding: "2.10.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:traefik:traefik:3.0.0:beta1:*:*:*:*:*:*",
                     matchCriteriaId: "376EAF9B-E994-4268-9704-0A45EA30270F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:traefik:traefik:3.0.0:beta2:*:*:*:*:*:*",
                     matchCriteriaId: "F3D08335-C291-4623-B80C-3B14C4D1FA32",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:traefik:traefik:3.0.0:beta3:*:*:*:*:*:*",
                     matchCriteriaId: "21033CEE-CEF5-4B0D-A565-4A6FC764AA6D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:projectcontour:contour:*:*:*:*:*:kubernetes:*:*",
                     matchCriteriaId: "FC4C66B1-42C0-495D-AE63-2889DE0BED84",
                     versionEndExcluding: "2023-10-11",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:linkerd:linkerd:*:*:*:*:stable:kubernetes:*:*",
                     matchCriteriaId: "8633E263-F066-4DD8-A734-90207207A873",
                     versionEndIncluding: "2.12.5",
                     versionStartIncluding: "2.12.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:linkerd:linkerd:2.13.0:*:*:*:stable:kubernetes:*:*",
                     matchCriteriaId: "34A23BD9-A0F4-4D85-8011-EAC93C29B4E8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:linkerd:linkerd:2.13.1:*:*:*:stable:kubernetes:*:*",
                     matchCriteriaId: "27ED3533-A795-422F-B923-68BE071DC00D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:linkerd:linkerd:2.14.0:*:*:*:stable:kubernetes:*:*",
                     matchCriteriaId: "45F7E352-3208-4188-A5B1-906E00DF9896",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:linkerd:linkerd:2.14.1:*:*:*:stable:kubernetes:*:*",
                     matchCriteriaId: "DF89A8AD-66FE-439A-B732-CAAB304D765B",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:linecorp:armeria:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A400C637-AF18-4BEE-B57C-145261B65DEC",
                     versionEndExcluding: "1.26.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:3scale_api_management_platform:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "653A5B08-0D02-4362-A8B1-D00B24C6C6F2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B0E6B4B-BAA6-474E-A18C-72C9719CEC1F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:advanced_cluster_security:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F0FD736A-8730-446A-BA3A-7B608DB62B0E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:advanced_cluster_security:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4C504B6-3902-46E2-82B7-48AEC9CDD48D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:ansible_automation_platform:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7B4BE2D6-43C3-4065-A213-5DB1325DC78F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_optaplanner:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1D54F5AE-61EC-4434-9D5F-9394A3979894",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:ceph_storage:5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E37E1B3-6F68-4502-85D6-68333643BDFF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:cert-manager_operator_for_red_hat_openshift:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6D5A7736-A403-4617-8790-18E46CB74DA6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33F13B03-69BF-4A8B-A0A0-7F47FD857461",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:certification_for_red_hat_enterprise_linux:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9393119E-F018-463F-9548-60436F104195",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:cost_management:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DC45EE1E-2365-42D4-9D55-92FA24E5ED3A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:cryostat:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E567CD9F-5A43-4D25-B911-B5D0440698F4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "68146098-58F8-417E-B165-5182527117C4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:fence_agents_remediation_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CB4D6790-63E5-4043-B8BE-B489D649061D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "78698F40-0777-4990-822D-02E1B5D0E2C0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EF03BDE8-602D-4DEE-BA5B-5B20FDF47741",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:7:*:*:*:*:*:*:*",
                     matchCriteriaId: "A58966CB-36AF-4E64-AB39-BE3A0753E155",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq_streams:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "585BC540-073B-425B-B664-5EA4C00AFED6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_core_services:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "9B453CF7-9AA6-4B94-A003-BF7AE0B82F53",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:logging_subsystem_for_red_hat_openshift:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EF93A27E-AA2B-4C2E-9B8D-FE7267847326",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:machine_deletion_remediation_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2B12A3A8-6456-481A-A0C9-524543FCC149",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3C2E7E3C-A507-4AB2-97E5-4944D8775CF7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:migration_toolkit_for_containers:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E22EBF9-AA0D-4712-9D69-DD97679CE835",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:migration_toolkit_for_virtualization:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "941B114C-FBD7-42FF-B1D8-4EA30E99102C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:network_observability_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "339CFB34-A795-49F9-BF6D-A00F3A1A4F63",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:node_healthcheck_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "8D044DBE-6F5A-4C53-828E-7B1A570CACFF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:node_maintenance_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E23FA47F-B967-44AD-AB76-1BB2CAD3CA5B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift:-:*:*:*:*:aws:*:*",
                     matchCriteriaId: "65203CA1-5225-4E55-A187-6454C091F532",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_api_for_data_protection:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7BF8EFFB-5686-4F28-A68F-1A8854E098CE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "932D137F-528B-4526-9A89-CD59FA1AB0FE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform_assisted_installer:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5DA9B2E2-958B-478D-87D6-E5CDDCD44315",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_data_science:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B3F5FF1E-5DA3-4EC3-B41A-A362BDFC4C69",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_dev_spaces:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "99B8A88B-0B31-4CFF-AFD7-C9D3DDD5790D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_developer_tools_and_services:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "97321212-0E07-4CC2-A917-7B5F61AB9A5A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_distributed_tracing:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DF390236-3259-4C8F-891C-62ACC4386CD1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_gitops:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C0AAA300-691A-4957-8B69-F6888CC971B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_pipelines:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "45937289-2D64-47CB-A750-5B4F0D4664A0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_sandboxed_containers:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B129311C-EB4B-4041-B85C-44D5E53FCAA3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_secondary_scheduler_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1AB54DB-3FB4-41CB-88ED-1400FD22AB85",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_serverless:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "77675CB7-67D7-44E9-B7FF-D224B3341AA5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_service_mesh:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A76A2BCE-4AAE-46D7-93D6-2EDE0FC83145",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_virtualization:4:*:*:*:*:*:*:*",
                     matchCriteriaId: "9C877879-B84B-471C-80CF-0656521CA8AB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "DCC81071-B46D-4F5D-AC25-B4A4CCC20C73",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B3000D2-35DF-4A93-9FC0-1AD3AB8349B8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openstack_platform:17.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "E315FC5C-FF19-43C9-A58A-CF2A5FF13824",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B1987BDA-0113-4603-B9BE-76647EB043F2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:run_once_duration_override_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D482A3D2-6E9B-42BA-9926-35E5BDD5F3BF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "848C92A9-0677-442B-8D52-A448F2019903",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:self_node_remediation_operator:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F564701-EDC1-43CF-BB9F-287D6992C6CB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:service_interconnect:1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "12B0CF2B-D1E1-4E20-846E-6F0D873499A9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:support_for_spring_boot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E8885C2C-7FB8-40CA-BCB9-B48C50BF2499",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:web_terminal:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "9D88B140-D2A1-4A0A-A2E9-1A3B50C295AD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7F6FB57C-2BC7-487C-96DD-132683AEB35D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:service_telemetry_framework:1.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "A903C3AD-2D25-45B5-BF4A-A5BEB2286627",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*",
                     matchCriteriaId: "E30D0E6F-4AE8-4284-8716-991DFA48CC5D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*",
                     matchCriteriaId: "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:astra_control_center:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EC5EBD2A-32A3-46D5-B155-B44DCB7F6902",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:akka:http_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C2792650-851F-4820-B003-06A4BEA092D7",
                     versionEndExcluding: "10.5.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:konghq:kong_gateway:*:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "9F6B63B9-F4C9-4A3F-9310-E0918E1070D1",
                     versionEndExcluding: "3.4.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*",
                     matchCriteriaId: "E6FF5F80-A991-43D4-B49F-D843E2BC5798",
                     versionEndIncluding: "2.414.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*",
                     matchCriteriaId: "54D25DA9-12D0-4F14-83E6-C69D0293AAB9",
                     versionEndIncluding: "2.427",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:solr:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "8E1AFFB9-C717-4727-B0C9-5A0C281710E2",
                     versionEndExcluding: "9.4.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "25C85001-E0AB-4B01-8EE7-1D9C77CD956E",
                     versionEndExcluding: "1.21.4.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:connected_mobile_experiences:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F98F9D27-6659-413F-8F29-4FDB0882AAC5",
                     versionEndExcluding: "11.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:crosswork_data_gateway:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C98BF315-C563-47C2-BAD1-63347A3D1008",
                     versionEndExcluding: "4.1.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:crosswork_data_gateway:5.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "705CBA49-21C9-4400-B7B9-71CDF9F97D8B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:crosswork_zero_touch_provisioning:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "AA2BE0F1-DD16-4876-8EBA-F187BD38B159",
                     versionEndExcluding: "6.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:data_center_network_manager:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "796B6C58-2140-4105-A2A1-69865A194A75",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:enterprise_chat_and_email:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DEA99DC6-EA03-469F-A8BE-7F96FDF0B333",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:expressway:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6560DBF4-AFE6-4672-95DE-74A0B8F4170A",
                     versionEndExcluding: "x14.3.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:firepower_threat_defense:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "84785919-796D-41E5-B652-6B5765C81D4A",
                     versionEndExcluding: "7.4.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:iot_field_network_director:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "92A74A1A-C69F-41E6-86D0-D6BB1C5D0A1E",
                     versionEndExcluding: "4.11.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_access_registrar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6FE7BA33-2AC0-4A85-97AD-6D77F20BA2AD",
                     versionEndExcluding: "9.3.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_cable_provisioning:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4FE2F959-1084-48D1-B1F1-8182FC9862DD",
                     versionEndExcluding: "7.2.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5CC17E6B-D7AB-40D7-AEC5-F5B555AC4D7F",
                     versionEndExcluding: "3.10.4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_network_registrar:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1BB6B48E-EA36-40A0-96D0-AF909BEC1147",
                     versionEndExcluding: "11.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:secure_dynamic_attributes_connector:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2CBED844-7F94-498C-836D-8593381A9657",
                     versionEndExcluding: "2.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:secure_malware_analytics:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "C170DBA1-0899-4ECC-9A0D-8FEB1DA1B510",
                     versionEndExcluding: "2.19.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:telepresence_video_communication_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "358FA1DC-63D3-49F6-AC07-9E277DD0D9DA",
                     versionEndExcluding: "x14.3.3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:ultra_cloud_core_-_policy_control_function:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BFF2D182-7599-4B81-B56B-F44EDA1384C0",
                     versionEndExcluding: "2024.01.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:ultra_cloud_core_-_policy_control_function:2024.01.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4868BCCA-24DE-4F24-A8AF-B3A545C0396E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:ultra_cloud_core_-_serving_gateway_function:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "194F7A1F-FD43-4FF7-9AE2-C13AA5567E8A",
                     versionEndExcluding: "2024.02.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:ultra_cloud_core_-_session_management_function:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "BEC75F99-C7F0-47EB-9032-C9D3A42EBA20",
                     versionEndExcluding: "2024.02.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:unified_attendant_console_advanced:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B6638F4E-16F7-447D-B755-52640BCB1C61",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:unified_contact_center_domain_manager:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "AC34F742-530E-4AB4-8AFC-D1E088E256B4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:unified_contact_center_enterprise:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D31CC0E9-8E21-436B-AB84-EA1B1BC60DCD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:unified_contact_center_enterprise_-_live_data_server:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E22AD683-345B-4E16-BB9E-E9B1783E09AD",
                     versionEndExcluding: "12.6.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:unified_contact_center_management_portal:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D5C0D694-9E24-4782-B35F-D7C3E3B0F2ED",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:cisco:fog_director:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2955BEE9-F567-4006-B96D-92E10FF84DB4",
                     versionEndExcluding: "1.22",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:cisco:ios_xe:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "67502878-DB20-4410-ABA0-A1C5705064CD",
                     versionEndExcluding: "17.15.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:cisco:ios_xr:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "177DED2D-8089-4494-BDD9-7F84FC06CD5B",
                     versionEndExcluding: "7.11.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:cisco:secure_web_appliance_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "54A29FD3-4128-4333-8445-A7DD04A6ECF6",
                     versionEndExcluding: "15.1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:cisco:secure_web_appliance:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "67074526-9933-46B3-9FE3-A0BE73C5E8A7",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "EEB32D2E-AD9D-44A0-AEF7-689F7D2605C9",
                     versionEndExcluding: "10.2\\(7\\)",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A236A0A-6956-4D79-B8E5-B2D0C79FAE88",
                     versionEndExcluding: "10.3\\(5\\)",
                     versionStartIncluding: "10.3\\(1\\)",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3016:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "528ED62B-D739-4E06-AC64-B506FD73BBAB",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3016q:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2D402AB0-BCFB-4F42-8C50-5DC930AEEC8B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3048:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC2A6C31-438A-4CF5-A3F3-364B1672EB7D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3064:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "76C10D85-88AC-4A79-8866-BED88A0F8DF8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3064-32t:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "09AC2BAD-F536-48D0-A2F0-D4E290519EB6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3064-t:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "65CB7F6D-A82B-4A31-BFAC-FF4A4B8DF9C1",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3064-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "ECC4FFCC-E886-49BC-9737-5B5BA2AAB14B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3064t:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F4E8EE4-031D-47D3-A12E-EE5F792172EE",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3064x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "00CDD8C3-67D5-4E9F-9D48-A77B55DB0AB1",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "41C14CC9-C244-4B86-AEA6-C50BAD5DA9A6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100-v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A8FF2EC4-0C09-4C00-9956-A2A4A894F63D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100-z:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D14D4B4E-120E-4607-A4F1-447C7BF3052E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3100v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "15702ACB-29F3-412D-8805-E107E0729E35",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_31108pc-v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E930332-CDDD-48D5-93BC-C22D693BBFA2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_31108pv-v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "29B34855-D8D2-4114-80D2-A4D159C62458",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_31108tc-v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7BF4B8FE-E134-4491-B5C2-C1CFEB64731B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_31128pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4226DA0-9371-401C-8247-E6E636A116C3",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3132c-z:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7664666F-BCE4-4799-AEEA-3A73E6AD33F4",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3132q:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D3DBBFE9-835C-4411-8492-6006E74BAC65",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3132q-v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B3293438-3D18-45A2-B093-2C3F65783336",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3132q-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C97C29EE-9426-4BBE-8D84-AB5FF748703D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3132q-x\\/3132q-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E142C18F-9FB5-4D96-866A-141D7D16CAF7",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3132q-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "8F43B770-D96C-44EA-BC12-9F39FC4317B9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3164q:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "FA782EB3-E8E6-4DCF-B39C-B3CBD46E4384",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7817F4E6-B2DA-4F06-95A4-AF329F594C02",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CED628B5-97A8-4B26-AA40-BEC854982157",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172pq-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7BB9DD73-E31D-4921-A6D6-E14E04703588",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172pq\\/pq-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "8EFC116A-627F-4E05-B631-651D161217C8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172tq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4532F513-0543-4960-9877-01F23CA7BA1B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172tq-32t:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "0B43502B-FD53-465A-B60F-6A359C6ACD99",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3172tq-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F3229124-B097-4AAC-8ACD-2F9C89DCC3AB",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3200:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "32A532C0-B0E3-484A-B356-88970E7D0248",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3232:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "1C84D24C-2256-42AF-898A-221EBE9FE1E4",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3232c:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "652A2849-668D-4156-88FB-C19844A59F33",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3232c_:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D008CA1C-6F5A-40EA-BB12-A9D84D5AF700",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3264c-e:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "24FBE87B-8A4F-43A8-98A3-4A7D9C630937",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3264q:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6ACD09AC-8B28-4ACB-967B-AB3D450BC137",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3400:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "43913A0E-50D5-47DD-94D8-DD3391633619",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3408-s:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7D397349-CCC6-479B-9273-FB1FFF4F34F2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_34180yc:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DC7286A7-780F-4A45-940A-4AD5C9D0F201",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_34200yc-sm:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CA52D5C1-13D8-4D23-B022-954CCEF491F1",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3432d-s:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F7AF8D7-431B-43CE-840F-CC0817D159C0",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3464c:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DAC204C8-1A5A-4E85-824E-DC9B8F6A802D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3500:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A8E1073F-D374-4311-8F12-AD8C72FAA293",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3524:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EAF5AF71-15DF-4151-A1CF-E138A7103FC8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3524-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "10F80A72-AD54-4699-B8AE-82715F0B58E2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3524-x\\/xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E505C0B1-2119-4C6A-BF96-C282C633D169",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3524-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "9354B6A2-D7D6-442E-BF4C-FE8A336D9E94",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3548:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "088C0323-683A-44F5-8D42-FF6EC85D080E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3548-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "74CB4002-7636-4382-B33E-FBA060A13C34",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3548-x\\/xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "915EF8F6-6039-4DD0-B875-30D911752B74",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3548-xl:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "10CEBF73-3EE0-459A-86C5-F8F6243FE27C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3600:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "97217080-455C-48E4-8CE1-6D5B9485864F",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_36180yc-r:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "95D2C4C3-65CE-4612-A027-AF70CEFC3233",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_3636c-r:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "57572E4A-78D5-4D1A-938B-F05F01759612",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "EEB32D2E-AD9D-44A0-AEF7-689F7D2605C9",
                     versionEndExcluding: "10.2\\(7\\)",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:cisco:nx-os:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A236A0A-6956-4D79-B8E5-B2D0C79FAE88",
                     versionEndExcluding: "10.3\\(5\\)",
                     versionStartIncluding: "10.3\\(1\\)",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9000v:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "0CD9C1F1-8582-4F67-A77D-97CBFECB88B8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9200:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "532CE4B0-A3C9-4613-AAAF-727817D06FB4",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9200yc:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "24CA1A59-2681-4507-AC74-53BD481099B9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92160yc-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4283E433-7F8C-4410-B565-471415445811",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92160yc_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "AF9147C9-5D8B-40F5-9AAA-66A3495A0AD8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9221c:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "FFB9FDE8-8533-4F65-BF32-4066D042B2F7",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92300yc:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F80AB6FB-32FD-43D7-A9F1-80FA47696210",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92300yc_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "3AA5389A-8AD1-476E-983A-54DF573C30F5",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92304qc:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D5B2E4C1-2627-4B9D-8E92-4B483F647651",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92304qc_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C1B1A8F1-45B1-4E64-A254-7191FA93CB6D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9232e:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "83DA8BFA-D7A2-476C-A6F5-CAE610033BC2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_92348gc-x:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "557ED31C-C26A-4FAE-8B14-D06B49F7F08B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9236c:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "11411BFD-3F4D-4309-AB35-A3629A360FB0",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9236c_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DB2FFD26-8255-4351-8594-29D2AEFC06EF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9272q:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E663DE91-C86D-48DC-B771-FA72A8DF7A7C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9272q_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "61E10975-B47E-4F4D-8096-AEC7B7733612",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9300:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "92E2CB2B-DA11-4CF7-9D57-3D4D48990DC0",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-ex:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A90184B3-C82F-4CE5-B2AD-97D5E4690871",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-ex-24:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "40E40F42-632A-47DF-BE33-DC25B826310B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-ex_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2C67B7A6-9BB2-41FC-8FA3-8D0DF67CBC68",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-fx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4AB89849-6DA4-4C9D-BC3F-EE0E41FD1901",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-fx-24:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C47F6BF9-2ADB-41A4-8D7D-8BB00141BB23",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-fx3h:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "16C64136-89C2-443C-AF7B-BED81D3DE25A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93108tc-fx3p:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "BBEF7F26-BB47-44BD-872E-130820557C23",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93120tx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "07DE6F63-2C7D-415B-8C34-01EC05C062F3",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93120tx_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "182000E0-8204-4D8B-B7DE-B191AFE12E28",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93128:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F309E7B9-B828-4CD2-9D2B-8966EE5B9CC1",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93128tx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F423E45D-A6DD-4305-9C6A-EAB26293E53A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93128tx_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "BDC208BC-7E19-48C6-A20E-A79A51B7362C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9316d-gx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "102F91CD-DFB6-43D4-AE5B-DA157A696230",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180lc-ex:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E952A96A-0F48-4357-B7DD-1127D8827650",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180lc-ex_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "084D0191-563B-4FF0-B589-F35DA118E1C6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180tc-ex:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B7DB6FC5-762A-4F16-AE8C-69330EFCF640",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-ex:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F70D81F1-8B12-4474-9060-B4934D8A3873",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-ex-24:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5394DE31-3863-4CA9-B7B1-E5227183100D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-ex_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "968390BC-B430-4903-B614-13104BFAE635",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-fx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7349D69B-D8FA-4462-AA28-69DD18A652D9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-fx-24:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE4BB834-2C00-4384-A78E-AF3BCDDC58AF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-fx3:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B0D30D52-837F-4FDA-B8E5-A9066E9C6D2F",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-fx3h:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E6678B8A-D905-447E-BE7E-6BFB4CC5DAFE",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93180yc-fx3s:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7CE49B45-F2E9-491D-9C29-1B46E9CE14E2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93216tc-fx2:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B1CC5F78-E88B-4B82-9E3E-C73D3A49DE26",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93240tc-fx2:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4BFAD21E-59EE-4CCE-8F1E-621D2EA50905",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93240yc-fx2:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "91231DC6-2773-4238-8C14-A346F213B5E5",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9332c:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2DF88547-BAF4-47B0-9F60-80A30297FCEB",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9332d-gx2b:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "02C3CE6D-BD54-48B1-A188-8E53DA001424",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9332d-h2r:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "498991F7-39D6-428C-8C7D-DD8DC72A0346",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9332pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "113772B6-E9D2-4094-9468-3F4E1A87D07D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9332pq_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F7B90D36-5124-4669-8462-4EAF35B0F53D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93360yc-fx2:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C45A38D6-BED6-4FEF-AD87-A1E813695DE0",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9336c-fx2:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1FC2B1F-232E-4754-8076-CC82F3648730",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9336c-fx2-e:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7CDD27C9-5EAF-4956-8AB7-740C84C9D4FC",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9336pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F1127D2-12C0-454F-91EF-5EE334070D06",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9336pq_aci:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7D6EB963-E0F2-4A02-8765-AB2064BE19E9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9336pq_aci_spine:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "785FD17C-F32E-4042-9DDE-A89B3AAE0334",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9336pq_aci_spine_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DEAAF99B-5406-4722-81FB-A91CBAC2DF41",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9348d-gx2a:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "73DC1E93-561E-490C-AE0E-B02BAB9A7C8E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9348gc-fx3:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "12DA2DE5-8ADA-4D6A-BC1A-9C06FA163B1C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9348gc-fxp:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "17C7E3DB-8E1A-47AD-B1C5-61747DC0CFB9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_93600cd-gx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2CF467E2-4567-426E-8F48-39669E0F514C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9364c:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "63842B25-8C32-4988-BBBD-61E9CB09B4F3",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9364c-gx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "68EA1FEF-B6B6-49FE-A0A4-5387F76303F8",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9364d-gx2a:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "40D6DB7F-C025-4971-9615-73393ED61078",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372px:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4364ADB9-8162-451D-806A-B98924E6B2CF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372px-e:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B53BCB42-ED61-4FCF-8068-CB467631C63C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372px-e_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "737C724A-B6CD-4FF7-96E0-EBBF645D660E",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372px_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7067AEC7-DFC8-4437-9338-C5165D9A8F36",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372tx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "49E0371B-FDE2-473C-AA59-47E1269D050F",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372tx-e:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "489D11EC-5A18-4F32-BC7C-AC1FCEC27222",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372tx-e_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "71D4CF15-B293-4403-A1A9-96AD3933BAEF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9372tx_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DBCC1515-2DBE-4DF2-8E83-29A869170F36",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9396px:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "1BC5293E-F2B4-46DC-85DA-167EA323FCFD",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9396px_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7282AAFF-ED18-4992-AC12-D953C35EC328",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9396tx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EA022E77-6557-4A33-9A3A-D028E2DB669A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9396tx_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "360409CC-4172-4878-A76B-EA1C1F8C7A79",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9408:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D8D5D5E2-B40B-475D-9EF3-8441016E37E9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9432pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "FDA8E1F0-74A6-4725-B6AA-A1112EFC5D0C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "63BE0266-1C00-4D6A-AD96-7F82532ABAA7",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_16-slot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "73F59A4B-AE92-4533-8EDC-D1DD850309FF",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_4-slot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "492A2C86-DD38-466B-9965-77629A73814F",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_8-slot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "1FB7AA46-4018-4925-963E-719E1037F759",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_supervisor_a:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "31B9D1E4-10B9-4B6F-B848-D93ABF6486D6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_supervisor_a\\+:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CB270C45-756E-400A-979F-D07D750C881A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_supervisor_b:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E8A085C-2DBA-4269-AB01-B16019FBB4DA",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500_supervisor_b\\+:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A79DD582-AF68-44F1-B640-766B46EF2BE2",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9500r:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B04484DA-AA59-4833-916E-6A8C96D34F0D",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9504:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "768BE390-5ED5-48A7-9E80-C4DE8BA979B1",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9504_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "D07B5399-44C7-468D-9D57-BB5B5E26CE50",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9508:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "DDC2F709-AFBE-48EA-A3A2-DA1134534FB6",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9508_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B76FB64F-16F0-4B0B-B304-B46258D434BA",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9516:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7E02DC82-0D26-436F-BA64-73C958932B0A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9516_switch:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "2E128053-834B-4DD5-A517-D14B4FC2B56F",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9536pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "163743A1-09E7-4EC5-8ECA-79E4B9CE173B",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9636pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE340E4C-DC48-4FC8-921B-EE304DB5AE0A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9716d-gx:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C367BBE0-D71F-4CB5-B50E-72B033E73FE1",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9736pq:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "85E1D224-4751-4233-A127-A041068C804A",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9800:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "BD31B075-01B1-429E-83F4-B999356A0EB9",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9804:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A10C9C0A-C96A-4B45-90D0-6ED457EB5F4C",
                     vulnerable: false,
                  },
                  {
                     criteria: "cpe:2.3:h:cisco:nexus_9808:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "3284D16F-3275-4F8D-8AE4-D413DE19C4FA",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.",
      },
      {
         lang: "es",
         value: "El protocolo HTTP/2 permite una denegación de servicio (consumo de recursos del servidor) porque la cancelación de solicitudes puede restablecer muchas transmisiones rápidamente, como se explotó en la naturaleza entre agosto y octubre de 2023.",
      },
   ],
   id: "CVE-2023-44487",
   lastModified: "2025-04-12T01:00:01.957",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2023-10-10T14:15:10.883",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/10/6",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/10/7",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/13/4",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/13/9",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/18/4",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/18/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/19/6",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/20/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/cve/cve-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Technical Description",
            "Vendor Advisory",
         ],
         url: "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://blog.vespa.ai/cve-2023-44487/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.suse.com/show_bug.cgi?id=1216123",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Technical Description",
            "Vendor Advisory",
         ],
         url: "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Technical Description",
            "Vendor Advisory",
         ],
         url: "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Technical Description",
            "Third Party Advisory",
         ],
         url: "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/Azure/AKS/issues/3947",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/Kong/kong/discussions/11741",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mitigation",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://github.com/advisories/GHSA-vx74-f528-fxqg",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/akka/akka-http/issues/4323",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/alibaba/tengine/issues/1872",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/apache/apisix/issues/10320",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/apache/httpd-site/pull/10",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
         ],
         url: "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
            "Third Party Advisory",
         ],
         url: "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/apache/trafficserver/pull/10564",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/bcdannyboy/CVE-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://github.com/caddyserver/caddy/issues/5877",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Third Party Advisory",
         ],
         url: "https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://github.com/dotnet/announcements/issues/277",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
            "Release Notes",
         ],
         url: "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/eclipse/jetty.project/issues/10679",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/envoyproxy/envoy/pull/30055",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/etcd-io/etcd/issues/16740",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/facebook/proxygen/pull/466",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/golang/go/issues/63417",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/grpc/grpc-go/pull/6703",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://github.com/grpc/grpc/releases/tag/v1.59.2",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/h2o/h2o/pull/3291",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/haproxy/haproxy/issues/2312",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
         ],
         url: "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/junkurihara/rust-rpxy/issues/97",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
         ],
         url: "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/kazu-yamamoto/http2/issues/93",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/kubernetes/kubernetes/pull/121120",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/line/armeria/pull/5232",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
         ],
         url: "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/micrictor/http2-rst-stream",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/microsoft/CBL-Mariner/pull/6381",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
         ],
         url: "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/nghttp2/nghttp2/pull/1961",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
         ],
         url: "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/ninenines/cowboy/issues/1615",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/nodejs/node/pull/50121",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/openresty/openresty/issues/930",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/opensearch-project/data-prepper/issues/3474",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/oqtane/oqtane.framework/discussions/3367",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/projectcontour/contour/pull/5826",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/tempesta-tech/tempesta/issues/1986",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/varnishcache/varnish-cache/issues/3996",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://istio.io/latest/news/security/istio-security-2023-004/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mitigation",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://my.f5.com/manage/s/article/K000137106",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://netty.io/news/2023/10/10/4-1-100-Final.html",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://news.ycombinator.com/item?id=37830987",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Press/Media Coverage",
         ],
         url: "https://news.ycombinator.com/item?id=37830998",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://news.ycombinator.com/item?id=37831062",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
         ],
         url: "https://news.ycombinator.com/item?id=37837043",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.gentoo.org/glsa/202311-09",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20231016-0001/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20240426-0007/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20240621-0007/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://security.paloaltonetworks.com/CVE-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
         ],
         url: "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://ubuntu.com/security/CVE-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "US Government Resource",
         ],
         url: "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Vendor Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5521",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Vendor Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5522",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5540",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5549",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5558",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5570",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.openwall.com/lists/oss-security/2023/10/10/6",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Press/Media Coverage",
         ],
         url: "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/13/4",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/13/9",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/18/4",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/18/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/19/6",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2023/10/20/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/cve/cve-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://aws.amazon.com/security/security-bulletins/AWS-2023-011/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Technical Description",
            "Vendor Advisory",
         ],
         url: "https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://blog.vespa.ai/cve-2023-44487/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.proxmox.com/show_bug.cgi?id=4988",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2242803",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.suse.com/show_bug.cgi?id=1216123",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Technical Description",
            "Vendor Advisory",
         ],
         url: "https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Technical Description",
            "Vendor Advisory",
         ],
         url: "https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Technical Description",
            "Third Party Advisory",
         ],
         url: "https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/Azure/AKS/issues/3947",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/Kong/kong/discussions/11741",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/advisories/GHSA-qppj-fm5r-hxr3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mitigation",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://github.com/advisories/GHSA-vx74-f528-fxqg",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://github.com/advisories/GHSA-xpw8-rcwv-8f8p",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/akka/akka-http/issues/4323",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/alibaba/tengine/issues/1872",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/apache/apisix/issues/10320",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/apache/httpd-site/pull/10",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
         ],
         url: "https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
            "Third Party Advisory",
         ],
         url: "https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/apache/trafficserver/pull/10564",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://github.com/bcdannyboy/CVE-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://github.com/caddyserver/caddy/issues/5877",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
         ],
         url: "https://github.com/caddyserver/caddy/releases/tag/v2.7.5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://github.com/dotnet/announcements/issues/277",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
            "Release Notes",
         ],
         url: "https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/eclipse/jetty.project/issues/10679",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/envoyproxy/envoy/pull/30055",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/etcd-io/etcd/issues/16740",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/facebook/proxygen/pull/466",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/golang/go/issues/63417",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/grpc/grpc-go/pull/6703",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/h2o/h2o/pull/3291",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/haproxy/haproxy/issues/2312",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
         ],
         url: "https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/junkurihara/rust-rpxy/issues/97",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/kazu-yamamoto/http2/issues/93",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/kubernetes/kubernetes/pull/121120",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/line/armeria/pull/5232",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://github.com/micrictor/http2-rst-stream",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/microsoft/CBL-Mariner/pull/6381",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
         ],
         url: "https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/nghttp2/nghttp2/pull/1961",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/ninenines/cowboy/issues/1615",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/nodejs/node/pull/50121",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/openresty/openresty/issues/930",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/opensearch-project/data-prepper/issues/3474",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/oqtane/oqtane.framework/discussions/3367",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
         ],
         url: "https://github.com/projectcontour/contour/pull/5826",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/tempesta-tech/tempesta/issues/1986",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://github.com/varnishcache/varnish-cache/issues/3996",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://istio.io/latest/news/security/istio-security-2023-004/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mitigation",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://my.f5.com/manage/s/article/K000137106",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://netty.io/news/2023/10/10/4-1-100-Final.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://news.ycombinator.com/item?id=37830987",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Press/Media Coverage",
         ],
         url: "https://news.ycombinator.com/item?id=37830998",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://news.ycombinator.com/item?id=37831062",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://news.ycombinator.com/item?id=37837043",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.gentoo.org/glsa/202311-09",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20231016-0001/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20240426-0007/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20240621-0006/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20240621-0007/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://security.paloaltonetworks.com/CVE-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
         ],
         url: "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://ubuntu.com/security/CVE-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "US Government Resource",
         ],
         url: "https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Vendor Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5521",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Vendor Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5522",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5540",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5549",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5558",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.debian.org/security/2023/dsa-5570",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://www.openwall.com/lists/oss-security/2023/10/10/6",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Press/Media Coverage",
         ],
         url: "https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Press/Media Coverage",
            "Third Party Advisory",
         ],
         url: "https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Analyzed",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-09-16 19:15
Modified
2024-11-21 04:55
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1828476Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1828476Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
redhat jboss_fuse 7.0.0
redhat wildfly *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "53A3AB58-49BA-4A9E-9419-C2787118368C",
                     versionEndExcluding: "13.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL). This setting is exposed as a public method, which can bypass the security manager. The highest threat from this vulnerability is to confidentiality.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en Wildfly versiones anteriores a wildfly-embedded-13.0.0.Final, donde la API del proceso administrado incorporado presenta una configuración expuesta del Thread Context Classloader (TCCL).&#xa0;Esta configuración se expone como un método público, que puede omitir al administrador de seguridad.&#xa0;La mayor amenaza de esta vulnerabilidad es la confidencialidad",
      },
   ],
   id: "CVE-2020-10718",
   lastModified: "2024-11-21T04:55:55.247",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-09-16T19:15:13.210",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1828476",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1828476",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-03-16 21:15
Modified
2024-11-21 05:46
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Summary
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1923405Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://github.com/fabric8io/kubernetes-client/issues/2715Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1923405Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/fabric8io/kubernetes-client/issues/2715Patch, Third Party Advisory
Impacted products
Vendor Product Version
redhat kubernetes-client *
redhat kubernetes-client *
redhat kubernetes-client *
redhat kubernetes-client *
redhat a-mq_online -
redhat build_of_quarkus -
redhat codeready_studio 12.0
redhat descision_manager 7.0
redhat integration_camel_k -
redhat jboss_fuse 7.0.0
redhat openshift_container_platform 3.11
redhat process_automation 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "396A03F1-9514-4805-9AB5-6B31FD4B4413",
                     versionEndExcluding: "4.7.2",
                     versionStartIncluding: "4.2.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "15E80E40-DCBB-4043-B074-674D548FD0AA",
                     versionEndExcluding: "4.11.2",
                     versionStartIncluding: "4.8.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A777CC85-DC45-4E4B-B11C-E0CF9F06593D",
                     versionEndExcluding: "4.13.2",
                     versionStartIncluding: "4.12.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:kubernetes-client:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "70D40776-9CBC-4F2F-9702-525330082531",
                     versionEndExcluding: "5.0.2",
                     versionStartIncluding: "5.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:a-mq_online:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "E6C99D72-43AD-4A22-AE66-44E868323D4C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1BAF877F-B8D5-4313-AC5C-26BB82006B30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D5863BBF-829E-44EF-ACE8-61D5037251F6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*",
                     matchCriteriaId: "2F87326E-0B56-4356-A889-73D026DB1D4B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en fabric8 kubernetes-client en versión 4.2.0 y posteriores.&#xa0;Este fallo permite a un pod/container malicioso causar que unas aplicaciones que usan el comando \"copy\" de fabric8 kubernetes-client extraigan archivos fuera de la ruta de trabajo.&#xa0;La mayor amenaza de esta vulnerabilidad es la integridad y la disponibilidad del sistema.&#xa0;Esto ha sido corregido en kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2",
      },
   ],
   id: "CVE-2021-20218",
   lastModified: "2024-11-21T05:46:09.140",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5.8,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.2,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-03-16T21:15:10.930",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1923405",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/fabric8io/kubernetes-client/issues/2715",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1923405",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/fabric8io/kubernetes-client/issues/2715",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-22",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-08-01 14:29
Modified
2024-11-21 02:59
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.
References
secalert@redhat.comhttp://www.securityfocus.com/bid/94544Third Party Advisory, VDB Entry
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94544Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
redhat jboss_a-mq 6.0.0
redhat jboss_fuse 6.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C4404A-CFB7-4B47-9487-F998825C31CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack.",
      },
      {
         lang: "es",
         value: "Se ha detectado que el endpoint JMX de Red Hat JBoss Fuse 6 y Red Hat A-MQ 6 deserializa las credenciales que se les pasa. Un atacante podría explotar este error para iniciar un ataque de denegación de servicio (DoS).",
      },
   ],
   id: "CVE-2016-8653",
   lastModified: "2024-11-21T02:59:46.260",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-08-01T14:29:00.347",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94544",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94544",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2015-06-24 16:59
Modified
2025-04-12 10:46
Severity ?
Summary
main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
References
cve@mitre.orghttp://openwall.com/lists/oss-security/2014/08/26/1
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-0850.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-0851.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-1176.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-1551.html
cve@mitre.orghttp://www.securityfocus.com/bid/69317
cve@mitre.orghttps://github.com/AsyncHttpClient/async-http-client/issues/197Vendor Advisory
cve@mitre.orghttps://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
cve@mitre.orghttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
cve@mitre.orghttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2014/08/26/1
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0850.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0851.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1176.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1551.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/69317
af854a3a-2127-422b-91ae-364da2661108https://github.com/AsyncHttpClient/async-http-client/issues/197Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
Impacted products
Vendor Product Version
async-http-client_project async-http-client *
redhat jboss_fuse *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:async-http-client_project:async-http-client:*:beta24:*:*:*:*:*:*",
                     matchCriteriaId: "7316393E-F184-4521-B9A8-7C2F8032732E",
                     versionEndIncluding: "1.9.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "882CD859-9180-4AF7-A5E1-9CAB574CA667",
                     versionEndIncluding: "6.1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.",
      },
      {
         lang: "es",
         value: "main/java/com/ning/http/client/AsyncHttpClientConfig.java en Async Http Client (también conocido como AHC o async-http-client) anterior a 1.9.0 no requiere una coincidencia de nombre de anfitrión durante la verificación de los certificados X.509, lo que permite a atacantes man-in-the-middle falsificar servidores HTTPS a través de un certificado válido arbitrario.",
      },
   ],
   id: "CVE-2013-7398",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-06-24T16:59:01.280",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://openwall.com/lists/oss-security/2014/08/26/1",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/69317",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/AsyncHttpClient/async-http-client/issues/197",
      },
      {
         source: "cve@mitre.org",
         url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "cve@mitre.org",
         url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "cve@mitre.org",
         url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://openwall.com/lists/oss-security/2014/08/26/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/69317",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/AsyncHttpClient/async-http-client/issues/197",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-345",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-10-02 19:15
Modified
2024-11-21 04:18
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2019:2998Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2020:0727Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212Issue Tracking, Mitigation, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20220210-0017/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2019:2998Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0727Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212Issue Tracking, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20220210-0017/Third Party Advisory
Impacted products
Vendor Product Version
redhat undertow *
redhat jboss_data_grid *
redhat jboss_data_grid -
redhat jboss_enterprise_application_platform -
redhat jboss_fuse *
redhat openshift_application_runtimes -
redhat single_sign-on *
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
redhat jboss_enterprise_application_platform 7.2
redhat jboss_enterprise_application_platform 7.3
redhat jboss_enterprise_application_platform 7.4
redhat enterprise_linux 8.0
redhat jboss_enterprise_application_platform 7.2
redhat jboss_enterprise_application_platform 7.3
redhat jboss_enterprise_application_platform 7.4
redhat enterprise_linux 7.0
redhat jboss_enterprise_application_platform 7.2
redhat jboss_enterprise_application_platform 7.3
redhat enterprise_linux 6.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "D92CBDEE-B201-4457-B870-89910D746221",
                     versionEndExcluding: "2.0.20",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0071A5C4-0204-4043-89F4-5BCD9B1B0497",
                     versionEndIncluding: "7.3",
                     versionStartIncluding: "7.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*",
                     matchCriteriaId: "2BF03A52-4068-47EA-8846-1E5FB708CE1A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:-:*:*:*:text-only:*:*:*",
                     matchCriteriaId: "B8423D7F-3A8F-4AD8-BF51-245C9D8DD816",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "46A8F2BB-F64B-400F-BE0B-7E1AD0AEBD5D",
                     versionEndIncluding: "7.4",
                     versionStartIncluding: "7.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:text-only:*:*:*",
                     matchCriteriaId: "ADB40F59-CAAE-47D6-850C-12619D8D5B34",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "518027E2-CE5F-42E4-85B0-79A33B452C9D",
                     versionEndIncluding: "7.3",
                     versionStartIncluding: "7.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
                     matchCriteriaId: "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                     matchCriteriaId: "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                     matchCriteriaId: "B55E8D50-99B4-47EC-86F9-699B67D473CE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "0C3AA5CE-9ACB-4E96-A4C1-50A662D641FB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "B4911A72-5FAE-47C5-A141-2E3CA8E1CCAB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "645A908C-18C2-4AB1-ACE7-3969E3A552A5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F4CFF558-3C47-480D-A2F0-BABF26042943",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "0C3AA5CE-9ACB-4E96-A4C1-50A662D641FB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "B4911A72-5FAE-47C5-A141-2E3CA8E1CCAB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "645A908C-18C2-4AB1-ACE7-3969E3A552A5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "142AD0DD-4CF3-4D74-9442-459CE3347E3A",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "0C3AA5CE-9ACB-4E96-A4C1-50A662D641FB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "B4911A72-5FAE-47C5-A141-2E3CA8E1CCAB",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en, todas las versiones por debajo de la 2.0.20, en el registro DEBUG de Undertow para io.undertow.request.security. Si está habilitado, un atacante podría abusar de este fallo para conseguir las credenciales del usuario de los archivos de registro.",
      },
   ],
   id: "CVE-2019-10212",
   lastModified: "2024-11-21T04:18:39.980",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.8,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "LOW",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 0.5,
            impactScore: 4.2,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-10-02T19:15:11.703",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2019:2998",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2020:0727",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20220210-0017/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2019:2998",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2020:0727",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10212",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20220210-0017/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-532",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-532",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2014-04-17 14:55
Modified
2025-04-12 10:46
Severity ?
Summary
JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
redhat jboss_a-mq 6.0.0
redhat jboss_fuse 6.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "33C4404A-CFB7-4B47-9487-F998825C31CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.",
      },
      {
         lang: "es",
         value: "JBoss Fuse no habilitaba contraseñas cifradas por defecto en su uso de Apache Zookeeper. Esto permitió la divulgación de información confidencial a través del registro de usuarios locales. Nota: esta descripción ha sido actualizada. El texto anterior identificaba erróneamente el origen del problema como Zookeeper. Texto anterior: Apache Zookeeper registra contraseñas de administrador en texto claro, lo que permite a los usuarios locales obtener información sensible leyendo el registro.",
      },
   ],
   id: "CVE-2014-0085",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 2.1,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2014-04-17T14:55:06.467",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0085",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-255",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-09-23 13:15
Modified
2024-11-21 04:55
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1825714Issue Tracking, Mitigation, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20201223-0002/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1825714Issue Tracking, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201223-0002/Third Party Advisory
Impacted products
Vendor Product Version
redhat wildfly_elytron *
redhat codeready_studio 12.0
redhat descision_manager 7.0
redhat jboss_fuse 7.0.0
redhat process_automation 7.0
netapp oncommand_insight -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "DFA71264-A0E0-481E-A499-45BD1BA64E57",
                     versionEndExcluding: "1.11.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1BAF877F-B8D5-4313-AC5C-26BB82006B30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D5863BBF-829E-44EF-ACE8-61D5037251F6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en versión 1.11.3.Final y anteriores de WildFly Elytron.&#xa0;Cuando se usa la autenticación FORM de WildFly Elytron con un ID de sesión en la URL, un atacante podría llevar a cabo un ataque de fijación de sesión.&#xa0;La mayor amenaza de esta vulnerabilidad es la confidencialidad e integridad de los datos, así como la disponibilidad del sistema",
      },
   ],
   id: "CVE-2020-10714",
   lastModified: "2024-11-21T04:55:54.693",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "HIGH",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5.1,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 4.9,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.6,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-09-23T13:15:15.233",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1825714",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20201223-0002/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1825714",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20201223-0002/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-384",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-384",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-03-02 17:15
Modified
2024-11-21 04:27
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892Issue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://github.com/FasterXML/jackson-databind/issues/2462Issue Tracking, Third Party Advisory
secalert@redhat.comhttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20200904-0005/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2020:0729Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/FasterXML/jackson-databind/issues/2462Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200904-0005/Third Party Advisory
Impacted products
Vendor Product Version
fasterxml jackson-databind *
fasterxml jackson-databind *
fasterxml jackson-databind *
redhat decision_manager 7.0
redhat jboss_data_grid -
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 7.0
redhat jboss_fuse 7.0.0
redhat openshift_container_platform 4.3
redhat process_automation 7.0
apache geode 1.12.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "7036DA13-110D-40B3-8494-E361BBF4AFCD",
                     versionEndExcluding: "2.6.7.3",
                     versionStartIncluding: "2.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5F83B193-74CF-459A-8055-AE0F033D5BCB",
                     versionEndExcluding: "2.8.11.5",
                     versionStartIncluding: "2.7.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FE5543DD-3F9D-45EF-8034-E1EF9657955A",
                     versionEndExcluding: "2.9.10",
                     versionStartIncluding: "2.9.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "68146098-58F8-417E-B165-5182527117C4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*",
                     matchCriteriaId: "2BF03A52-4068-47EA-8846-1E5FB708CE1A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "88BF3B2C-B121-483A-AEF2-8082F6DA5310",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "6E57E25E-342F-411A-8840-6AF01078D09F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:geode:1.12.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8DD32C20-8B17-4197-9943-B8293D1C3BED",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.",
      },
      {
         lang: "es",
         value: "Se detectó un fallo en jackson-databind en las versiones anteriores a 2.9.10, 2.8.11.5 y 2.6.7.3, donde permitiría una deserialización polimórfica de un objeto malicioso utilizando las clases JNDI de commons-configuration 1 y 2. Un atacante podría usar este fallo para ejecutar código arbitrario.",
      },
   ],
   id: "CVE-2019-14892",
   lastModified: "2024-11-21T04:27:37.527",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-03-02T17:15:17.813",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2020:0729",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/FasterXML/jackson-databind/issues/2462",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20200904-0005/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2020:0729",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14892",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://github.com/FasterXML/jackson-databind/issues/2462",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20200904-0005/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-502",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-05-12 21:15
Modified
2024-11-21 05:11
Severity ?
7.1 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
redhat jboss_fuse 7.0.0
redhat keycloak *
redhat openshift_application_runtimes -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "637DA24E-DD9D-4895-8335-7C6A2AB6472F",
                     versionEndExcluding: "8.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en el flujo de restablecimiento de credenciales en todas las versiones de Keycloak versiones anteriores a 8.0.0. Este fallo permite a un atacante obtener acceso no autorizado a la aplicación.",
      },
   ],
   id: "CVE-2020-1718",
   lastModified: "2024-11-21T05:11:13.997",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.6,
            impactScore: 5.5,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-05-12T21:15:11.463",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-04-18 01:29
Modified
2024-11-21 03:09
Severity ?
4.8 (Medium) - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
5.9 (Medium) - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:0478Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:0479Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:0480Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:0481Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:1525Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:2405Vendor Advisory
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2018:3768Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://issues.jboss.org/browse/UNDERTOW-1190Issue Tracking
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:0478Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:0479Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:0480Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:0481Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:1525Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:2405Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2018:3768Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.jboss.org/browse/UNDERTOW-1190Issue Tracking
Impacted products
Vendor Product Version
redhat undertow *
redhat undertow 1.4.24
redhat undertow 2.0.2
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 6.0.0
redhat virtualization 4.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5EB2078E-40F6-4DAD-A307-E141E1CFB313",
                     versionEndIncluding: "1.4.18",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:1.4.24:*:*:*:*:*:*:*",
                     matchCriteriaId: "36FE5FE4-37B9-4FD7-A3FB-59DD4C6E372E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5270A0F-6A16-4ACE-8650-493D91A41EC4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.",
      },
      {
         lang: "es",
         value: "Se ha descubierto que undertow, en sus versiones 1.4.18.SP1, 2.0.2.Final y 1.4.24.Final, es vulnerable al usar la autenticación Digest, ya que el servidor no garantiza que el valor del URI en la cabecera Authorization coincida con el URIb en la línea de petición HTTP. Esto permite que el atacante provoque un ataque Man-in-the-Middle (MitM) y acceda al contenido que desee en el servidor.",
      },
   ],
   id: "CVE-2017-12196",
   lastModified: "2024-11-21T03:09:01.960",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.8,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 1.2,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-04-18T01:29:01.443",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0478",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0479",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0480",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0481",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:1525",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:2405",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:3768",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
         ],
         url: "https://issues.jboss.org/browse/UNDERTOW-1190",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0478",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0479",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0480",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:0481",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:1525",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:2405",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2018:3768",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12196",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
         ],
         url: "https://issues.jboss.org/browse/UNDERTOW-1190",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-863",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-07-24 16:15
Modified
2024-11-21 05:02
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
redhat amq 2.0
redhat jboss_enterprise_application_platform_continuous_delivery -
redhat jboss_fuse 6.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B6D3AF88-5812-4BB6-871F-C0EA39AD66AE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "BEFE06C8-4BF0-4EC0-A848-BF16CFCCDA57",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.",
      },
      {
         lang: "es",
         value: "Se encontró una vulnerabilidad en Wildfly's Enterprise Java Beans (EJB) versiones incluidas con Red Hat JBoss EAP 7, donde SessionOpenInvocations nunca es eliminada del InvocationTracker remoto después que una respuesta es recibida en el EJB Client, así como en el servidor. Este fallo permite a un atacante diseñar un ataque de denegación de servicio para hacer que el servicio no esté disponible",
      },
   ],
   id: "CVE-2020-14307",
   lastModified: "2024-11-21T05:02:58.360",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 4,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-07-24T16:15:11.897",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14307",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-404",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-404",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2015-06-24 16:59
Modified
2025-04-12 10:46
Severity ?
Summary
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
References
cve@mitre.orghttp://openwall.com/lists/oss-security/2014/08/26/1
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-0850.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-0851.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-1176.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-1551.html
cve@mitre.orghttp://www.securityfocus.com/bid/69316
cve@mitre.orghttps://github.com/AsyncHttpClient/async-http-client/issues/352Vendor Advisory
cve@mitre.orghttps://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
cve@mitre.orghttps://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
cve@mitre.orghttps://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2014/08/26/1
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0850.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-0851.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1176.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1551.html
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/69316
af854a3a-2127-422b-91ae-364da2661108https://github.com/AsyncHttpClient/async-http-client/issues/352Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20
Impacted products
Vendor Product Version
redhat jboss_fuse *
async-http-client_project async-http-client *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "882CD859-9180-4AF7-A5E1-9CAB574CA667",
                     versionEndIncluding: "6.1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:async-http-client_project:async-http-client:*:beta24:*:*:*:*:*:*",
                     matchCriteriaId: "7316393E-F184-4521-B9A8-7C2F8032732E",
                     versionEndIncluding: "1.9.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.",
      },
      {
         lang: "es",
         value: "Async Http Client (también conocido como AHC o async-http-client) anterior a 1.9.0 salta la verificación los certificados X.509 a no ser que tanto una localización keyStore y una localización trustStore estén configuradas explícitamente, lo que permite a atacantes man-in-the-middle falsificar servidores HTTPS mediante la presentación de un certificado arbitrario durante el uso de una configuración AHC típica, tal y como fue demostrado por una configuración que no envía certificados de cliente.",
      },
   ],
   id: "CVE-2013-7397",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-06-24T16:59:00.093",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://openwall.com/lists/oss-security/2014/08/26/1",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/69316",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/AsyncHttpClient/async-http-client/issues/352",
      },
      {
         source: "cve@mitre.org",
         url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "cve@mitre.org",
         url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "cve@mitre.org",
         url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://openwall.com/lists/oss-security/2014/08/26/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0850.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-0851.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1551.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/69316",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/AsyncHttpClient/async-http-client/issues/352",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-06-20",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-345",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-03-16 15:15
Modified
2024-11-21 04:27
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://issues.redhat.com/browse/JBEAP-17965Permissions Required
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20200327-0007/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.redhat.com/browse/JBEAP-17965Permissions Required
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200327-0007/Third Party Advisory
Impacted products
Vendor Product Version
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0
redhat wildfly 7.2.0
redhat wildfly 7.2.3
redhat wildfly 7.2.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly:7.2.0:general_availability:*:*:*:*:*:*",
                     matchCriteriaId: "3183A7CF-6426-4B9F-AC91-9CFD6F31CD2A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly:7.2.3:general_availability:*:*:*:*:*:*",
                     matchCriteriaId: "FA943E12-A502-40E7-833D-79C504667EA6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly:7.2.5:cr2:*:*:*:*:*:*",
                     matchCriteriaId: "DFBEF324-BC86-4DA8-9152-6E339C8751F4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.",
      },
      {
         lang: "es",
         value: "Se detectó un fallo cuando un proveedor de seguridad OpenSSL es usado con Wildfly, el valor de \"enabled-protocols\" en la configuración de Wildfly no es respetado. Un atacante podría apuntar al tráfico enviado desde Wildfly y degradar la conexión a una versión más débil de TLS, rompiendo potencialmente el cifrado. Esto podría conllevar a un filtrado de los datos que son pasados a través de la red. Se cree que Wildfly versiones 7.2.0.GA, 7.2.3.GA y 7.2.5.CR2 son vulnerables.",
      },
   ],
   id: "CVE-2019-14887",
   lastModified: "2024-11-21T04:27:36.843",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 6.4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.2,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 9.1,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.2,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-03-16T15:15:12.130",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Permissions Required",
         ],
         url: "https://issues.redhat.com/browse/JBEAP-17965",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20200327-0007/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14887",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Permissions Required",
         ],
         url: "https://issues.redhat.com/browse/JBEAP-17965",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20200327-0007/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-757",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2024-08-21 14:15
Modified
2024-12-12 22:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:11023
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:6508
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:6883
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:7441
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:7442
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:7735
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:7736
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2024-7885Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2305290Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20241011-0004/
Impacted products
Vendor Product Version
redhat build_of_apache_camel_-_hawtio -
redhat build_of_apache_camel_for_spring_boot -
redhat build_of_keycloak -
redhat data_grid 8.0.0
redhat integration_camel_k -
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_enterprise_application_platform 8.0.0
redhat jboss_fuse 7.0.0
redhat process_automation 7.0
redhat single_sign-on 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_apache_camel_-_hawtio:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "4B1DC0F4-BF84-4399-9487-DEF10CEC3D97",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_apache_camel_for_spring_boot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EDE67672-8894-448B-84B5-3CD3610A8117",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "824BB506-D01A-4C88-AD4A-3C94A2409CD2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:data_grid:8.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3311F2A9-C028-4765-BF79-BC370D15550C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "0D8BC03A-4198-4488-946B-3F6B43962942",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments.",
      },
      {
         lang: "es",
         value: "Se encontró una vulnerabilidad en Undertow donde ProxyProtocolReadListener reutiliza la misma instancia de StringBuilder en múltiples solicitudes. Este problema ocurre cuando el método parseProxyProtocolV1 procesa múltiples solicitudes en la misma conexión HTTP. Como resultado, diferentes solicitudes pueden compartir la misma instancia de StringBuilder, lo que podría provocar una fuga de información entre solicitudes o respuestas. En algunos casos, un valor de una solicitud o respuesta anterior puede reutilizarse por error, lo que podría provocar una exposición no deseada de los datos. Este problema produce principalmente errores y terminación de la conexión, pero crea un riesgo de fuga de datos en entornos de solicitudes múltiples.",
      },
   ],
   id: "CVE-2024-7885",
   lastModified: "2024-12-12T22:15:08.717",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-08-21T14:15:09.500",
   references: [
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:11023",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:6508",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:6883",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:7441",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:7442",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:7735",
      },
      {
         source: "secalert@redhat.com",
         url: "https://access.redhat.com/errata/RHSA-2024:7736",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/cve/CVE-2024-7885",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2305290",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20241011-0004/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-362",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-08-05 21:15
Modified
2024-11-21 06:22
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1981407Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1981407Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
redhat wildfly_elytron *
redhat wildfly_elytron *
redhat wildfly_elytron *
redhat build_of_quarkus -
redhat codeready_studio 12.0
redhat data_grid 8.0
redhat descision_manager 7.0
redhat integration_camel_k -
redhat integration_camel_quarkus *
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_enterprise_application_platform_expansion_pack -
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat process_automation 7.0
quarkus quarkus *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "3CB7C68F-D18A-4F07-8505-4B116A719CE3",
                     versionEndExcluding: "1.10.14",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "B84CCC98-0A89-4B0E-BBBF-D31F274454E8",
                     versionEndExcluding: "1.15.5",
                     versionStartIncluding: "1.11.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly_elytron:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "23DE02D1-460C-4EE2-B7CA-E8FF2BAB928D",
                     versionEndExcluding: "1.16.1",
                     versionStartIncluding: "1.16.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:codeready_studio:12.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "1BAF877F-B8D5-4313-AC5C-26BB82006B30",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:data_grid:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7095200A-4DAC-4433-99E8-86CA88E1E4D4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:descision_manager:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "D5863BBF-829E-44EF-ACE8-61D5037251F6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_quarkus:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5FC54571-8F52-434F-BE20-96ECFC7195F7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform_expansion_pack:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "0A24CBFB-4900-47A5-88D2-A44C929603DC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "68DC3D37-B532-4EEC-8D38-2710EBE2F85B",
                     versionEndIncluding: "2.1.4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.",
      },
      {
         lang: "es",
         value: "Se ha detectado un fallo en Wildfly Elytron en versiones anteriores a 1.10.14.Final, en versiones anteriores a la 1.15.5.Final y en versiones anteriores a la 1.16.1.Final donde ScramServer puede ser susceptible a Timing Attack si está habilitado. La mayor amenaza de esta vulnerabilidad es la confidencialidad.",
      },
   ],
   id: "CVE-2021-3642",
   lastModified: "2024-11-21T06:22:03.467",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 3.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 6.8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.6,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-08-05T21:15:13.183",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1981407",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1981407",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-203",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-203",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-07-24 16:15
Modified
2024-11-21 05:02
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297Issue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
redhat amq 2.0
redhat jboss-ejb-client *
redhat jboss_enterprise_application_platform_continuous_delivery -
redhat jboss_fuse 6.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:amq:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B6D3AF88-5812-4BB6-871F-C0EA39AD66AE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss-ejb-client:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "09D26C4C-4795-4D49-BA57-7242324B8E2A",
                     versionEndExcluding: "4.0.34",
                     versionStartIncluding: "1.0.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform_continuous_delivery:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "BEFE06C8-4BF0-4EC0-A848-BF16CFCCDA57",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.",
      },
      {
         lang: "es",
         value: "Se detectó un fallo en Wildfly's EJB Client que se incluyó con Red Hat JBoss EAP 7, donde algunos objetos de transacción EJB específicos pueden ser acumulados con el tiempo y pueden causar que los servicios se ralenticen y eventualmente no estén disponibles. Un atacante puede tomar ventaja y causar un ataque de denegación de servicio y hacer que los servicios no estén disponibles",
      },
   ],
   id: "CVE-2020-14297",
   lastModified: "2024-11-21T05:02:57.103",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 4,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-07-24T16:15:11.803",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14297",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-12-20 14:15
Modified
2024-11-21 02:43
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
swagger-ui has XSS in key names
References
cve@mitre.orghttp://www.securityfocus.com/bid/97580Third Party Advisory, VDB Entry
cve@mitre.orghttps://access.redhat.com/errata/RHSA-2017:0868Third Party Advisory
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229Issue Tracking, Third Party Advisory
cve@mitre.orghttps://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.jsonThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/97580Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:0868Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.jsonThird Party Advisory
Impacted products
Vendor Product Version
smartbear swagger-ui -
redhat jboss_fuse 6.3
redhat openshift 2.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:smartbear:swagger-ui:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B8195A94-B057-43E4-9AD4-59B7CA47B97D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "D071664D-9B31-45EB-A5DD-237EB3F36E63",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift:2.0:*:*:*:enterprise:*:*:*",
                     matchCriteriaId: "884F5BE8-59F5-4502-9765-F3A3E505570F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "swagger-ui has XSS in key names",
      },
      {
         lang: "es",
         value: "swagger-ui presenta una vulnerabilidad de tipo XSS en nombres claves.",
      },
   ],
   id: "CVE-2016-1000229",
   lastModified: "2024-11-21T02:43:01.303",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-12-20T14:15:11.633",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/97580",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2017:0868",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/97580",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2017:0868",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000229",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000229.json",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-02-23 19:15
Modified
2024-11-21 05:21
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1901304Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1901304Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
redhat jboss_fuse 6.0.0
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat undertow 2.0.33
redhat undertow 2.1.5
redhat undertow 2.2.3


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.33:sp2:*:*:*:*:*:*",
                     matchCriteriaId: "A2CDD487-FEA3-4471-B9F3-A2C24278DBF8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.1.5:sp1:*:*:*:*:*:*",
                     matchCriteriaId: "914B537C-9326-49DB-BED4-38203821613D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.2.3:sp1:*:*:*:*:*:*",
                     matchCriteriaId: "0022DD37-7025-469C-B855-B38D516D2C9B",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en el conector AJP de Undertow.&#xa0;Peticiones maliciosas y cierres de conexiones abruptas podrían ser desencadenadas por un atacante usando cadenas de consulta con caracteres que no cumplen con RFC, resultando en una denegación de servicio.&#xa0;La mayor amenaza de esta vulnerabilidad es la disponibilidad del sistema.&#xa0;Esto afecta a Undertow versiones 2.1.5.SP1, 2.0.33.SP2 y 2.2.3.SP1",
      },
   ],
   id: "CVE-2020-27782",
   lastModified: "2024-11-21T05:21:49.550",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 7.8,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:C",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-02-23T19:15:13.150",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1901304",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1901304",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-06-02 13:15
Modified
2024-11-21 05:03
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1860218Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
secalert@redhat.comhttps://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1860218Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.htmlPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpujan2022.htmlPatch, Third Party Advisory
Impacted products
Vendor Product Version
redhat xnio *
redhat xnio *
redhat xnio 3.6.0
redhat xnio 3.6.0
redhat jboss_brms 5
redhat jboss_brms 6
redhat jboss_data_grid 6.0.0
redhat jboss_data_grid 7.0.0
redhat jboss_data_virtualization 6.0.0
redhat jboss_enterprise_application_platform 5.0.0
redhat jboss_enterprise_application_platform 6.0.0
redhat jboss_fuse 6.0.0
redhat jboss_fuse 7.0.0
redhat jboss_operations_network 3.0
redhat jboss_soa_platform 5
oracle communications_cloud_native_core_console 1.9.0
oracle communications_cloud_native_core_network_repository_function 1.14.0
oracle communications_cloud_native_core_policy 1.14.0
oracle communications_cloud_native_core_security_edge_protection_proxy 1.15.0
oracle communications_cloud_native_core_service_communication_proxy 1.14.0
oracle communications_cloud_native_core_unified_data_repository 1.14.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:xnio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "51EE6E12-A43A-4F53-9750-35D8BDF16100",
                     versionEndExcluding: "3.7.9",
                     versionStartIncluding: "3.6.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:xnio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F5A1F231-972E-455F-8BA0-06627A715061",
                     versionEndExcluding: "3.8.2",
                     versionStartIncluding: "3.8.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:xnio:3.6.0:beta1:*:*:*:*:*:*",
                     matchCriteriaId: "80259D1A-EC7A-4C72-A193-4E9F594BC1BC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:xnio:3.6.0:beta2:*:*:*:*:*:*",
                     matchCriteriaId: "2167DBAE-1F20-4B41-8D98-A3FAFDCBB510",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_brms:5:*:*:*:*:*:*:*",
                     matchCriteriaId: "BE5157F3-B74D-4066-AB34-8B42BBEB9C7B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_brms:6:*:*:*:*:*:*:*",
                     matchCriteriaId: "38DD6591-DB2A-4A1C-800B-D6C32C5D3065",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "372F543C-1516-4F17-B4B7-A67B7CAD6966",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_virtualization:6.0.0:-:*:*:*:*:*:*",
                     matchCriteriaId: "AB9104FA-3448-43E0-BED9-BAF7D06054E0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "F5D7F1AD-4BD3-4C37-B6B5-B287464B2EEB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B142ACCC-F7A9-4A3B-BE60-0D6691D5058D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_operations_network:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C077D692-150C-4AE9-8C0B-7A3EA5EB1100",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_soa_platform:5:*:*:*:*:*:*:*",
                     matchCriteriaId: "44D5DDAE-5519-4E9D-8DD0-D56E4E034F26",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_console:1.9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DAAB7154-4DE8-4806-86D0-C1D33B84417B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:1.14.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "8E463039-5E48-4AA0-A42B-081053FA0111",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "4479F76A-4B67-41CC-98C7-C76B81050F8E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.15.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A442DA9E-FF9A-4C51-9D3E-68D09C8BB472",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "0AB059F2-FEC4-4180-8A90-39965495055E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "5A276784-877B-4A29-A8F1-70518A438A9A",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.",
      },
      {
         lang: "es",
         value: "Se detectó una vulnerabilidad en XNIO en la que se produce un filtrado de descriptores de archivos causada por el crecimiento de la cantidad de manejadores de archivos NIO Selector entre los ciclos de recolección de basura. Puede permitir al atacante causar una denegación de servicio. Afecta a XNIO versiones 3.6.0.Beta1 hasta 3.8.1.Final",
      },
   ],
   id: "CVE-2020-14340",
   lastModified: "2024-11-21T05:03:02.780",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-06-02T13:15:08.083",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1860218",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpujan2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1860218",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpuapr2022.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://www.oracle.com/security-alerts/cpujan2022.html",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-Other",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2018-07-26 15:29
Modified
2024-11-21 03:23
Severity ?
8.7 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
9.0 (Critical) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Summary
It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2017:1832Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/errata/RHSA-2017:1832Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
hawt hawtio 1.4.0
redhat jboss_fuse 6.3


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hawt:hawtio:1.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "ADADDFFB-A294-4F5D-B70A-E4AE083AA6A7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "D071664D-9B31-45EB-A5DD-237EB3F36E63",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.",
      },
      {
         lang: "es",
         value: "Se ha descubierto que el servlet 1.4 de hawtio utiliza una única instancia HttpClient para las peticiones del proxy con un almacén de cookies persistente (las cookies se almacenan localmente y no se pasan entre el cliente y la URL final), lo que significa que todos los clientes que utilicen ese proxy están compartiendo las mismas cookies.",
      },
   ],
   id: "CVE-2017-2589",
   lastModified: "2024-11-21T03:23:47.057",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 6.8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 8.7,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.3,
            impactScore: 5.8,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.3,
            impactScore: 6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-07-26T15:29:00.217",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2017:1832",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/errata/RHSA-2017:1832",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2589",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-285",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-02-11 18:15
Modified
2024-11-21 04:55
Severity ?
3.3 (Low) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1831662Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://issues.redhat.com/browse/KEYCLOAK-13653Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1831662Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.redhat.com/browse/KEYCLOAK-13653Permissions Required, Vendor Advisory
Impacted products
Vendor Product Version
redhat keycloak -
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6E0DE4E1-5D8D-40F3-8AC8-C7F736966158",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.",
      },
      {
         lang: "es",
         value: "Se encontró una vulnerabilidad en keycloak en la forma en que el endpoint de cierre de sesión OIDC no tiene protección CSRF.&#xa0;Se cree que las versiones enviadas con Red Hat Fuse 7, Red Hat Single Sign-on 7 y Red Hat Openshift Application Runtimes son vulnerables",
      },
   ],
   id: "CVE-2020-10734",
   lastModified: "2024-11-21T04:55:57.587",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "LOW",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "LOCAL",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 2.1,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:L/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "LOW",
               baseScore: 3.3,
               baseSeverity: "LOW",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-02-11T18:15:13.927",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1831662",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Permissions Required",
            "Vendor Advisory",
         ],
         url: "https://issues.redhat.com/browse/KEYCLOAK-13653",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1831662",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Permissions Required",
            "Vendor Advisory",
         ],
         url: "https://issues.redhat.com/browse/KEYCLOAK-13653",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-02-11 18:15
Modified
2024-11-21 05:11
Severity ?
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Summary
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1796281Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://issues.jboss.org/browse/KEYCLOAK-12014Issue Tracking, Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1796281Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.jboss.org/browse/KEYCLOAK-12014Issue Tracking, Permissions Required, Vendor Advisory
Impacted products
Vendor Product Version
redhat keycloak 7.0.1
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:keycloak:7.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "81B631C5-DBD4-4055-ADF3-4B2FECACE04F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en Keycloak versión 7.0.1.&#xa0;Un usuario que haya iniciado sesión puede llevar a cabo un ataque de enumeración de correo electrónico de la cuenta",
      },
   ],
   id: "CVE-2020-1717",
   lastModified: "2024-11-21T05:11:13.880",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 2.7,
               baseSeverity: "LOW",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-02-11T18:15:14.317",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1796281",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Permissions Required",
            "Vendor Advisory",
         ],
         url: "https://issues.jboss.org/browse/KEYCLOAK-12014",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1796281",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Permissions Required",
            "Vendor Advisory",
         ],
         url: "https://issues.jboss.org/browse/KEYCLOAK-12014",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-209",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-209",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2014-10-25 21:55
Modified
2025-04-12 10:46
Severity ?
Summary
The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
References
cve@mitre.orghttp://op-co.de/CVE-2014-5075.html
cve@mitre.orghttp://rhn.redhat.com/errata/RHSA-2015-1176.html
cve@mitre.orghttp://secunia.com/advisories/59915
cve@mitre.orghttp://www.securityfocus.com/bid/69064
af854a3a-2127-422b-91ae-364da2661108http://op-co.de/CVE-2014-5075.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1176.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/59915
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/69064
Impacted products
Vendor Product Version
redhat jboss_fuse *
igniterealtime smack_api *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "882CD859-9180-4AF7-A5E1-9CAB574CA667",
                     versionEndIncluding: "6.1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:igniterealtime:smack_api:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FD53CC15-FD13-4D63-B286-5D0FE7D7DC49",
                     versionEndIncluding: "4.0.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",
      },
      {
         lang: "es",
         value: "La API Ignite Realtime Smack XMPP 4.x anterior a 4.0.2, y 3.x y 2.x cuando se utiliza un SSLContext personalizado, no verifica que el nombre del servidor coincide con un nombre de dominio en el campo de asunto Common Name (CN) o subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle suplantar los servidores SSL a través de un certificado válido arbitrario.",
      },
   ],
   id: "CVE-2014-5075",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2014-10-25T21:55:04.177",
   references: [
      {
         source: "cve@mitre.org",
         url: "http://op-co.de/CVE-2014-5075.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "cve@mitre.org",
         url: "http://secunia.com/advisories/59915",
      },
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/69064",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://op-co.de/CVE-2014-5075.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://secunia.com/advisories/59915",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/69064",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-310",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-01-08 15:15
Modified
2024-11-21 04:27
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820Issue Tracking, Patch, Third Party Advisory
Impacted products
Vendor Product Version
redhat keycloak *
redhat single_sign-on 7.3
redhat jboss_enterprise_application_platform 6.4.0
redhat jboss_enterprise_application_platform 7.2.0
redhat jboss_fuse 7.0.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "637DA24E-DD9D-4895-8335-7C6A2AB6472F",
                     versionEndExcluding: "8.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "E939A0E0-3437-459E-9FAB-FE42811B1D32",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.4.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B1ABA871-3271-48E2-A69C-5AD70AF94E53",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "0952BA1A-5DF9-400F-B01F-C3A398A8A2D4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.",
      },
      {
         lang: "es",
         value: "Se descubrió que keycloak versiones anteriores la versión 8.0.0, expone los endpoints del adaptador interno en org.keycloak.constants.AdapterConstants, que pueden ser invocadas por medio de una URL especialmente diseñada. Esta vulnerabilidad podría permitir a un atacante acceder a información no autorizada.",
      },
   ],
   id: "CVE-2019-14820",
   lastModified: "2024-11-21T04:27:25.867",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-01-08T15:15:11.260",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-04-21 17:15
Modified
2024-11-21 05:11
Severity ?
8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Summary
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757Issue Tracking, Vendor Advisory
Impacted products
Vendor Product Version
redhat undertow *
redhat undertow 2.0.0
redhat undertow 2.0.25
redhat undertow 2.0.26
redhat undertow 2.0.28
redhat undertow 2.0.28
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 6.0.0
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EDBDBF5-063C-46B8-B20B-C0508D2C7333",
                     versionEndExcluding: "2.1.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.0:sp1:*:*:*:*:*:*",
                     matchCriteriaId: "242ADB09-4679-419A-B7D8-CB97BC4914A5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.25:sp1:*:*:*:*:*:*",
                     matchCriteriaId: "E2AFB127-09B5-4C57-9FBC-D9EF99A20629",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.26:sp3:*:*:*:*:*:*",
                     matchCriteriaId: "8A26525F-D91D-4009-84DA-A9A9646AF483",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.28:sp1:*:*:*:*:*:*",
                     matchCriteriaId: "BEDBD1BC-081D-436C-AF09-B3754C1EF6E2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.0.28:sp2:*:*:*:*:*:*",
                     matchCriteriaId: "5F06B9E4-1F1E-436E-B515-2A9950545034",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "A305F012-544E-4245-9D69-1C8CD37748B1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.",
      },
      {
         lang: "es",
         value: "Se encontró un fallo en todas las versiones undertow-2.x.x SP1 anteriores a undertow-2.0.30.SP1, en todas las versiones undertow-1.x.x y versiones undertow-2.x.x anteriores a undertow-2.1.0.Final, donde el contenedor de servlets causa que servletPath se normalice incorrectamente al truncar la ruta después del punto y coma, lo que puede conllevar a un mapeo de la aplicación resultando en la omisión de la seguridad.",
      },
   ],
   id: "CVE-2020-1757",
   lastModified: "2024-11-21T05:11:19.333",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.2,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.2,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-04-21T17:15:12.957",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1757",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2023-02-23 20:15
Modified
2025-03-12 15:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
References
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2022-4492Vendor Advisory
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2153260Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20230324-0002/
af854a3a-2127-422b-91ae-364da2661108https://access.redhat.com/security/cve/CVE-2022-4492Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2153260Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230324-0002/
Impacted products
Vendor Product Version
redhat build_of_quarkus -
redhat integration_camel_for_spring_boot -
redhat integration_camel_k -
redhat integration_service_registry -
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 7.0.0
redhat migration_toolkit_for_applications 6.0
redhat migration_toolkit_for_runtimes -
redhat single_sign-on 7.0
redhat undertow 2.7.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:build_of_quarkus:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "CE29B9D6-63DC-4779-ACE8-4E51E6A0AF37",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_for_spring_boot:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "78698F40-0777-4990-822D-02E1B5D0E2C0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:integration_service_registry:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "EF03BDE8-602D-4DEE-BA5B-5B20FDF47741",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3C2E7E3C-A507-4AB2-97E5-4944D8775CF7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:migration_toolkit_for_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F979A5E3-7FFB-45F1-9847-FFBAF0B12067",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E0FA5F7F-CCE8-4DF0-8F9D-516F72C30A45",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.",
      },
   ],
   id: "CVE-2022-4492",
   lastModified: "2025-03-12T15:15:38.020",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-02-23T20:15:12.680",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/cve/CVE-2022-4492",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2153260",
      },
      {
         source: "secalert@redhat.com",
         url: "https://security.netapp.com/advisory/ntap-20230324-0002/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://access.redhat.com/security/cve/CVE-2022-4492",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2153260",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://security.netapp.com/advisory/ntap-20230324-0002/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-918",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-05-13 19:15
Modified
2024-11-21 05:11
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://github.com/keycloak/keycloak/pull/7053Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/keycloak/keycloak/pull/7053Patch, Third Party Advisory
Impacted products
Vendor Product Version
redhat keycloak *
redhat decision_manager 7.0
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat process_automation 7.0
redhat single_sign-on 7.0
quarkus quarkus *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "255305D5-BC40-46ED-9937-1904D210885F",
                     versionEndExcluding: "11.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:decision_manager:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "68146098-58F8-417E-B165-5182527117C4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:process_automation:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "20A6B40D-F991-4712-8E30-5FE008505CB7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "DAD20C55-1888-477C-923F-B25E8B5CD239",
                     versionEndIncluding: "1.4.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.",
      },
      {
         lang: "es",
         value: "Se detectó un fallo en Keycloak versiones anteriores a 11.0.0, donde la base de código contiene usos de la función ObjectInputStream sin ningún tipo de comprobaciones. Este fallo permite a un atacante inyectar Objetos Java serializados arbitrariamente, que luego se deserializarán en un contexto privilegiado y conlleva potencialmente a una ejecución  de código remota.",
      },
   ],
   id: "CVE-2020-1714",
   lastModified: "2024-11-21T05:11:13.600",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 1.6,
            impactScore: 5.9,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-05-13T19:15:11.987",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/keycloak/keycloak/pull/7053",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/keycloak/keycloak/pull/7053",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2022-08-05 16:15
Modified
2024-11-21 07:00
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0Issue Tracking, Vendor Advisory
secalert@redhat.comhttps://issues.redhat.com/browse/UNDERTOW-2133Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.redhat.com/browse/UNDERTOW-2133Vendor Advisory
Impacted products
Vendor Product Version
redhat integration_camel_k -
redhat jboss_fuse 7.0.0
redhat undertow *
redhat undertow 2.3.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:integration_camel_k:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "B87C8AD3-8878-4546-86C2-BF411876648C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "581C0C48-DDC2-4781-9032-C5A0C2544C74",
                     versionEndExcluding: "2.2.19",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:undertow:2.3.0:alpha1:*:*:*:*:*:*",
                     matchCriteriaId: "F6DD3DE4-9C5D-4768-9414-C63D1D172B7F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in \"All workers are in error state\" and mod_cluster responds \"503 Service Unavailable\" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the \"retry\" timeout passes. However, luckily, mod_proxy_balancer has \"forcerecovery\" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding \"503 Service Unavailable\". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2.",
      },
      {
         lang: "es",
         value: "Cuando una petición POST llega a través de AJP y la petición excede el límite de tamaño máximo de post (maxEntitySize), la implementación AjpServerRequestConduit de Undertow cierra una conexión sin enviar ninguna respuesta al cliente/proxy. Este comportamiento resulta en que un proxy del front-end marque al trabajador del backend (servidor de aplicaciones) como un estado de error y no reenvíe peticiones al trabajador durante un tiempo. En mod_cluster, esto continúa hasta que la siguiente petición de STATUS (en intervalos de 10 segundos) del servidor de aplicaciones actualiza el estado del servidor. Así que, en el peor de los casos, puede resultar en \"Todos los trabajadores están en estado de error\" y mod_cluster responde \"503 Service Unavailable\" durante un tiempo (hasta 10 segundos). En mod_proxy_balancer, no reenvía las peticiones al trabajador hasta que pasa el tiempo de espera de \"reintento\". Sin embargo, por suerte, mod_proxy_balancer presenta el parámetro \"forcerecovery\" (habilitado por defecto; este parámetro puede forzar la recuperación inmediata de todos los trabajadores sin tener en cuenta el parámetro retry de los trabajadores si todos los trabajadores de un balanceador están en estado de error). Así, a diferencia de mod_cluster, mod_proxy_balancer no resulta en la respuesta \"503 Service Unavailable\". Un atacante podría usar este comportamiento para enviar una petición maliciosa y desencadenar errores en el servidor, resultando en DoS (denegación de servicio). Este fallo fue corregido en Undertow versión 2.2.19.Final, Undertow versión 2.3.0.Alpha2",
      },
   ],
   id: "CVE-2022-2053",
   lastModified: "2024-11-21T07:00:14.433",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-08-05T16:15:11.560",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://issues.redhat.com/browse/UNDERTOW-2133",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://issues.redhat.com/browse/UNDERTOW-2133",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-400",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2015-07-08 15:59
Modified
2025-04-12 10:46
Severity ?
Summary
Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file.
References
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1176.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2015-1177.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1176.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2015-1177.html
Impacted products
Vendor Product Version
redhat jboss_fuse *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "882CD859-9180-4AF7-A5E1-9CAB574CA667",
                     versionEndIncluding: "6.1.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file.",
      },
      {
         lang: "es",
         value: "Red Hat JBoss Fuse anterior a 6.2.0 permite a usuarios remotos autenticados evadir las restricciones y acceder a la consola HawtIO mediante el aprovechamiento de una cuenta definida en el fichero de propiedades de usuarios.",
      },
   ],
   id: "CVE-2014-8175",
   lastModified: "2025-04-12T10:46:40.837",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 6.8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
   },
   published: "2015-07-08T15:59:00.083",
   references: [
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "secalert@redhat.com",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1177.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1176.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://rhn.redhat.com/errata/RHSA-2015-1177.html",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-264",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2020-11-02 21:15
Modified
2024-11-21 05:18
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Summary
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689Exploit, Issue Tracking, Patch, Vendor Advisory
secalert@redhat.comhttps://security.netapp.com/advisory/ntap-20201123-0006/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689Exploit, Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20201123-0006/Third Party Advisory
Impacted products
Vendor Product Version
redhat wildfly *
redhat fuse 6.0.0
redhat jboss_data_grid 7.0.0
redhat jboss_enterprise_application_platform 7.0.0
redhat jboss_fuse 7.0.0
redhat openshift_application_runtimes -
redhat single_sign-on 7.0
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp active_iq_unified_manager -
netapp oncommand_insight -
netapp service_level_manager -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:wildfly:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "03BD2B88-A2AB-479B-8AE9-EB044A920A43",
                     versionEndIncluding: "21.0.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:fuse:6.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "FD89A07A-0277-43E8-9363-F77A43C89406",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "72A54BDA-311C-413B-8E4D-388AD65A170A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:openshift_application_runtimes:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "A33441B3-B301-426C-A976-08CE5FE72EFB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "9EFEC7CA-8DDA-48A6-A7B6-1F1D14792890",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*",
                     matchCriteriaId: "F3E0B672-3E06-4422-B2A4-0BD073AEC2A1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*",
                     matchCriteriaId: "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*",
                     matchCriteriaId: "B55E8D50-99B4-47EC-86F9-699B67D473CE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "F1BE6C1F-2565-4E97-92AA-16563E5660A5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "7081652A-D28B-494E-94EF-CA88117F23EE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.",
      },
      {
         lang: "es",
         value: "Se encontró una fallo de filtrado de memoria en WildFly en todas las versiones hasta 21.0.0.Final, donde el controlador de host intenta reconectarse en un bucle, generando nuevas conexiones que no son cerradas apropiadamente mientras no es capaz de conectar al controlador de dominio.&#xa0;Este fallo permite a un atacante causar un problema de Falta de Memoria (OOM), conllevando a una denegación de servicio.&#xa0;La mayor amenaza de esta vulnerabilidad es la disponibilidad del sistema",
      },
   ],
   id: "CVE-2020-25689",
   lastModified: "2024-11-21T05:18:28.603",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "COMPLETE",
               baseScore: 6.8,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:N/I:N/A:C",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 6.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.6,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2020-11-02T21:15:27.647",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20201123-0006/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Exploit",
            "Issue Tracking",
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "https://security.netapp.com/advisory/ntap-20201123-0006/",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-401",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-401",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-11-18 17:15
Modified
2024-11-21 04:18
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172Issue Tracking, Third Party Advisory
secalert@redhat.comhttps://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E
secalert@redhat.comhttps://lists.debian.org/debian-lts-announce/2020/01/msg00037.htmlMailing List, Third Party Advisory
secalert@redhat.comhttps://lists.debian.org/debian-lts-announce/2020/08/msg00039.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/01/msg00037.htmlMailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/08/msg00039.htmlMailing List, Third Party Advisory
Impacted products
Vendor Product Version
fasterxml jackson-mapper-asl *
redhat jboss_enterprise_application_platform 7.0
redhat jboss_fuse 7.0.0
debian debian_linux 8.0
debian debian_linux 9.0
apache spark 3.0.1


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:fasterxml:jackson-mapper-asl:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5946E031-5234-46C6-BA61-93A886C8BE8E",
                     versionEndIncluding: "1.9.13",
                     versionStartIncluding: "1.9.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "88BF3B2C-B121-483A-AEF2-8082F6DA5310",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:7.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "B40CCE4F-EA2C-453D-BB76-6388767E5C6D",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "DEECE5FC-CACF-4496-A3E7-164736409252",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:spark:3.0.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "9F972DB3-9775-49FE-9D84-D2F287EAB31F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.",
      },
      {
         lang: "es",
         value: "Se detectó un fallo en las bibliotecas org.codehaus.jackson:jackson-mapper-asl:1.9.x. Las vulnerabilidades de tipo XML external entity similares a CVE-2016-3720, también afectan a las bibliotecas codehaus jackson-mapper-asl pero en diferentes clases.",
      },
   ],
   id: "CVE-2019-10172",
   lastModified: "2024-11-21T04:18:34.477",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.9,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.2,
            impactScore: 3.6,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-11-18T17:15:11.063",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         url: "https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5b3487d363afdda80c996d7b930097383d%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r0fbf2c60967bc9f73d7f5a62ad3b955789f9a14b950f42e99fca9b4e%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r1cc8bce2cf3dfce08a64c4fa20bf38d33b56ad995cee2e382f522f83%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r1edabcfacdad42d3c830464e9cf07a9a489059a7b7a8642cf055542d%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r1f07e61b3ebabd3e5b4aa97bf1b26d98b793fdfa29a23dac60633f55%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r21ac3570ce865b8f1e5d26e492aeb714a6aaa53a0c9a6f72ef181556%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r25e25973e9577c62fd0221b4b52990851adf11cbe33036bd67d4b13d%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r33d25a342af84102903cd9dec8338a5bcba3ecfce10505bdfe793b92%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r356592d9874ab4bc9da4754592f8aa6edc894c95e17e58484bc2af7a%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r37eb6579fa0bf94a72b6c978e2fee96f68a2b1b3ac1b1ce60aee86cf%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r385c35a7c6f4acaacf37fe22922bb8e2aed9d322d0fa6dc1d45acddb%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r386966780034aadee69ffd82d44555117c9339545b9ce990fe490a3e%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r4176155240cdc36aad7869932d9c29551742c7fa630f209fb4a8e649%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r43c6f75d203b8afc4fbd6c3200db0384a18a11c59d085b1a9bb0ccfe%40%3Cuser.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r48a32f2dd6976d33f7a12b7e09ec7ea1895f8facba82b565587c28ac%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r4bbfa1439d7a4e1712e260bfc3d90f7cf997abfd641cccde6432d4ab%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r500867b74f42230a3d65b8aec31fc93ac390eeae737c91a759ab94cb%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r5f16a1bd31a7e94ca78eda686179930781aa3a4a990cd55986703581%40%3Cdev.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r634468eb3218ab02713128ff6f4818c618622b2b3de4d958138dde49%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r68acf97f4526ba59a33cc6e592261ea4f85d890f99e79c82d57dd589%40%3Cissues.spark.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r6dea2a887f5eb1d68f124d64b14cd1a04f682f06de8cd01b7e4214e0%40%3Cissues.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/r80e8882c86c9c17a57396a5ef7c4f08878d629a0291243411be0de3a%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/ra37700b842790883b9082e6b281fb7596f571b13078a4856cd38f2c2%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rb036bf32e4dacc49335e3bdc1be8e53d6f54df692ac8e2251a6884bd%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rb47911c179c9f3e8ea3f134b5645e63cd20c6fc63bd0b43ab5864bd1%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rb8c09b14fd57d855dc21e0a037dc29258c2cbe9c1966bfff453a02e4%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rce00a1c60f7df4b10e72fa87827c102f55b074bb91993631df2c21f9%40%3Cdev.hive.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rd27730cfc3066dfcf15927c8e800603728d5dedf17eee1f8c6e3507c%40%3Ccommon-issues.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/rd3a34d663e2a25b9ab1e8a1a94712cd5f100f098578aec79af48161e%40%3Ccommon-dev.hadoop.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/re07c51a8026c11e6e5513bfdc66d52d1c1027053e480fb8073356257%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "https://lists.apache.org/thread.html/re646dcc2739d92117bf9a76a33c600ed3b65e8b4e9b6f441e366b72b%40%3Ccommits.cassandra.apache.org%3E",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "https://lists.debian.org/debian-lts-announce/2020/08/msg00039.html",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-611",
            },
         ],
         source: "secalert@redhat.com",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-611",
            },
         ],
         source: "nvd@nist.gov",
         type: "Secondary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2019-08-01 14:15
Modified
2024-11-21 02:36
Severity ?
2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Summary
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559Issue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://issues.apache.org/jira/browse/AMQ-6470Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://issues.apache.org/jira/browse/AMQ-6470Patch, Vendor Advisory
Impacted products
Vendor Product Version
apache activemq *
apache activemq *
redhat jboss_a-mq 6.2.1
redhat jboss_a-mq 6.3
redhat jboss_fuse 6.3


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "19F3F7A9-36A3-4C80-A64F-93F1E36B0B29",
                     versionEndExcluding: "5.14.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "37F1391B-D441-48C7-B534-E657E6FE1FE2",
                     versionEndExcluding: "5.15.5",
                     versionStartIncluding: "5.15.0",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "03D90905-0F4C-4702-BD33-272740AF0B15",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_a-mq:6.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "9F7D1ECB-DF7E-4161-B844-E6F6004FDC52",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "D071664D-9B31-45EB-A5DD-237EB3F36E63",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.",
      },
      {
         lang: "es",
         value: "Se encontró que el cliente ActiveMQ de Apache anterior a versión 5.15.5, expuso un comando de apagado remoto en clase ActiveMQConnection. Un atacante que inicio sesión en un broker comprometido podría utilizar este fallo para lograr una denegación de servicio en un cliente conectado.",
      },
   ],
   id: "CVE-2015-7559",
   lastModified: "2024-11-21T02:36:58.990",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 4,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 2.7,
               baseSeverity: "LOW",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
               version: "3.0",
            },
            exploitabilityScore: 1.2,
            impactScore: 1.4,
            source: "secalert@redhat.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 2.7,
               baseSeverity: "LOW",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-08-01T14:15:10.940",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://issues.apache.org/jira/browse/AMQ-6470",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://issues.apache.org/jira/browse/AMQ-6470",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-306",
            },
         ],
         source: "secalert@redhat.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-12-29 22:29
Modified
2025-04-20 01:37
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1072716Issue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1eIssue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1072716Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1eIssue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
hawt hawtio *
redhat jboss_fuse 6.1.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hawt:hawtio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E2D6477F-AC38-49D3-B617-77FF372375D8",
                     versionEndIncluding: "1.2.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.1.0:beta:*:*:*:*:*:*",
                     matchCriteriaId: "522C7490-D292-43FF-ABA4-FB1FBA3A36DC",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter.",
      },
      {
         lang: "es",
         value: "El terminal de administrador en Hawt.io no requiere autenticación, lo que permite que atacantes remotos ejecuten comandos arbitrarios mediante el parámetro k.",
      },
   ],
   id: "CVE-2014-0121",
   lastModified: "2025-04-20T01:37:25.860",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-12-29T22:29:00.317",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072716",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072716",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/hawtio/hawtio/commit/5289715e4f2657562fdddcbad830a30969b96e1e",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-12-29 22:29
Modified
2025-04-20 01:37
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running "shutdown -f."
References
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=1072681Issue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113Issue Tracking, Patch, Third Party Advisory
secalert@redhat.comhttps://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=1072681Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdfIssue Tracking, Third Party Advisory
Impacted products
Vendor Product Version
hawt hawtio *
redhat jboss_fuse 6.1.0


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:hawt:hawtio:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "E2D6477F-AC38-49D3-B617-77FF372375D8",
                     versionEndIncluding: "1.2.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:redhat:jboss_fuse:6.1.0:beta:*:*:*:*:*:*",
                     matchCriteriaId: "522C7490-D292-43FF-ABA4-FB1FBA3A36DC",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run commands on the Karaf server, as demonstrated by running \"shutdown -f.\"",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el terminal de administrador en Hawt.io permite que atacantes remotos secuestren la autenticación de usuarios arbitrarios para peticiones que ejecutan comandos en el servidor Karaf, tal y como se demuestra ejecutando \"shutdown -f\".",
      },
   ],
   id: "CVE-2014-0120",
   lastModified: "2025-04-20T01:37:25.860",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 6.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-12-29T22:29:00.270",
   references: [
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072681",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113",
      },
      {
         source: "secalert@redhat.com",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://bugzilla.redhat.com/show_bug.cgi?id=1072681",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/hawtio/hawtio/commit/b4e23e002639c274a2f687ada980118512f06113",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Issue Tracking",
            "Third Party Advisory",
         ],
         url: "https://infocon.org/cons/SyScan/SyScan%202015%20Singapore/SyScan%202015%20Singapore%20presentations/SyScan15%20David%20Jorm%20-%20Finding%20and%20exploiting%20novel%20flaws%20in%20Java%20software.pdf",
      },
   ],
   sourceIdentifier: "secalert@redhat.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-352",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}