{
"$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"serialNumber": "urn:uuid:415c3bd4-1785-422e-a555-c64a2ea652f3",
"version": 1,
"metadata": {
"timestamp": "2026-04-03T15:56:55+00:00",
"tools": {
"components": [
{
"type": "application",
"manufacturer": {
"name": "Aqua Security Software Ltd."
},
"group": "aquasecurity",
"name": "trivy",
"version": "0.69.3"
}
]
},
"component": {
"bom-ref": "pkg:oci/cp-zookeeper@sha256%3A4fc92a55bb6b2700aa9c1328dd8356cfb05fcd56280e817647056df5126f864b?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-zookeeper",
"type": "container",
"supplier": {
"name": "Confluent"
},
"name": "cp-zookeeper",
"version": "7.5.13",
"purl": "pkg:oci/cp-zookeeper@sha256%3A4fc92a55bb6b2700aa9c1328dd8356cfb05fcd56280e817647056df5126f864b?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-zookeeper",
"properties": [
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:0be8320754563b670e552ec2a36c600678007f043948701b79b7689c5c57899f"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:1066c8ae460aaabe9706f756a22b62e5d6652db7673573f09fe219e3ce328429"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:55c272f76da082d2aeb0aa37b77abb878a939dc1d939d1c83330494e4b0357ce"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:63e10a11097512478270eccb2dba3f2c27e7e4145eedaa5b77e37787b3059ff2"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:6b958473b7015a735b3093656a2edad323bf01cb07452a5eb46e359baab65f49"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:78fbb0801e2d2dd23a536deab6999c18721829f70e8d5b36180ac46d3fc6486f"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:7c17c7492abdf413d43143fe74f1d31658a33e82699a016cbbecd18fa5e04784"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:a38c4c1cf048a8523012dc673b2f2feee3c9694225b23c33c6661b9b234e396d"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:a815ab31ecad1d28ff164fe102912c0f2ef4be3d44f6d181549aa7875cd3c15c"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:c53f841ef881e36ae71b6ac1cdf7ba02e4c30066f5b6106bcec9b4ebe7270e30"
},
{
"name": "aquasecurity:trivy:DiffID",
"value": "sha256:eb089c54b61cc358999b2eec915e0ba4c741a641c48a1ce7c865f4bb0af1ebf3"
},
{
"name": "aquasecurity:trivy:ImageID",
"value": "sha256:19b3da6a260f146889efbd04a4ca260e6e5907aac144b1af1eeb418169e948ef"
},
{
"name": "aquasecurity:trivy:Labels:architecture",
"value": "x86_64"
},
{
"name": "aquasecurity:trivy:Labels:build-date",
"value": "2026-02-11T04:49:43Z"
},
{
"name": "aquasecurity:trivy:Labels:com.redhat.component",
"value": "ubi8-minimal-container"
},
{
"name": "aquasecurity:trivy:Labels:com.redhat.license_terms",
"value": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI"
},
{
"name": "aquasecurity:trivy:Labels:cpe",
"value": "cpe:/a:redhat:enterprise_linux:8::appstream"
},
{
"name": "aquasecurity:trivy:Labels:description",
"value": "ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services."
},
{
"name": "aquasecurity:trivy:Labels:distribution-scope",
"value": "public"
},
{
"name": "aquasecurity:trivy:Labels:io.buildah.version",
"value": "1.42.2"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker",
"value": "true"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker.build.number",
"value": "90ede733"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker.git.id",
"value": "5a4cf4b"
},
{
"name": "aquasecurity:trivy:Labels:io.confluent.docker.git.repo",
"value": "confluentinc/kafka-images"
},
{
"name": "aquasecurity:trivy:Labels:io.k8s.description",
"value": "The Universal Base Image Minimal is a stripped down image that uses microdnf as a package manager. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly."
},
{
"name": "aquasecurity:trivy:Labels:io.k8s.display-name",
"value": "Red Hat Universal Base Image 8 Minimal"
},
{
"name": "aquasecurity:trivy:Labels:io.openshift.tags",
"value": "minimal rhel8"
},
{
"name": "aquasecurity:trivy:Labels:maintainer",
"value": "partner-support@confluent.io"
},
{
"name": "aquasecurity:trivy:Labels:name",
"value": "cp-zookeeper"
},
{
"name": "aquasecurity:trivy:Labels:org.opencontainers.image.created",
"value": "2026-02-11T04:49:43Z"
},
{
"name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision",
"value": "1e787622a9711280b3af2a32f69e499d3e11a5d4"
},
{
"name": "aquasecurity:trivy:Labels:release",
"value": "7.5.13-26"
},
{
"name": "aquasecurity:trivy:Labels:summary",
"value": "ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services."
},
{
"name": "aquasecurity:trivy:Labels:url",
"value": "https://catalog.redhat.com/en/search?searchType=containers"
},
{
"name": "aquasecurity:trivy:Labels:vcs-ref",
"value": "1e787622a9711280b3af2a32f69e499d3e11a5d4"
},
{
"name": "aquasecurity:trivy:Labels:vcs-type",
"value": "git"
},
{
"name": "aquasecurity:trivy:Labels:vendor",
"value": "Confluent"
},
{
"name": "aquasecurity:trivy:Labels:version",
"value": "5a4cf4b"
},
{
"name": "aquasecurity:trivy:Reference",
"value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper:7.5.13-rc260218111616-latest-ubi8"
},
{
"name": "aquasecurity:trivy:RepoDigest",
"value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper@sha256:4fc92a55bb6b2700aa9c1328dd8356cfb05fcd56280e817647056df5126f864b"
},
{
"name": "aquasecurity:trivy:RepoTag",
"value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-zookeeper:7.5.13-rc260218111616-latest-ubi8"
},
{
"name": "aquasecurity:trivy:SchemaVersion",
"value": "2"
},
{
"name": "aquasecurity:trivy:Size",
"value": "757995008"
}
]
}
},
"components": [],
"dependencies": [],
"vulnerabilities": [
{
"id": "CVE-2005-2541",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 10,
"severity": "high",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"
},
{
"source": {
"name": "redhat"
},
"score": 7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2005-2541"
},
{
"url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2005-2541"
},
{
"url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2005-2541"
}
],
"published": "2005-08-10T04:00:00+00:00",
"updated": "2025-04-03T01:03:51+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2018-1000654",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:C"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1000654"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html"
},
{
"url": "http://www.securityfocus.com/bid/105151"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1000654"
},
{
"url": "https://gitlab.com/gnutls/libtasn1/issues/4"
},
{
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000654"
},
{
"url": "https://ubuntu.com/security/notices/USN-5352-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000654"
}
],
"published": "2018-08-20T19:31:44+00:00",
"updated": "2024-11-21T03:40:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.13-5.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-1000879",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
}
],
"cwes": [
476
],
"description": "libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards) contains a CWE-476: NULL Pointer Dereference vulnerability in ACL parser - libarchive/archive_acl.c, archive_acl_from_text_l() that can result in Crash/DoS. This attack appear to be exploitable via the victim must open a specially crafted archive file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1000879"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html"
},
{
"url": "http://www.securityfocus.com/bid/106324"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1000879"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000879"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000879"
}
],
"published": "2018-12-20T17:29:01+00:00",
"updated": "2024-11-21T03:40:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-1000880",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
119
],
"description": "libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1000880"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html"
},
{
"url": "http://www.securityfocus.com/bid/106324"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1000880"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105"
},
{
"url": "https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc349f6d70b5f8168b5680"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000880"
},
{
"url": "https://ubuntu.com/security/notices/USN-3859-1"
},
{
"url": "https://usn.ubuntu.com/3859-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1000880"
},
{
"url": "https://www.debian.org/security/2018/dsa-4360"
}
],
"published": "2018-12-20T17:29:01+00:00",
"updated": "2024-11-21T03:40:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-1121",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 3.9,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
367,
362
],
"description": "procps-ng, procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order, a process occupying a high PID can use inotify events to determine when the process list is being scanned, and fork/exec to obtain a lower PID, thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15, newer versions might be affected also.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-1121"
},
{
"url": "http://seclists.org/oss-sec/2018/q2/122"
},
{
"url": "http://www.securityfocus.com/bid/104214"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-1121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1121"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1121"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-1121"
},
{
"url": "https://www.exploit-db.com/exploits/44806/"
},
{
"url": "https://www.qualys.com/2018/05/17/procps-ng-audit-report-advisory.txt"
}
],
"published": "2018-06-13T20:29:00+00:00",
"updated": "2024-11-21T03:59:13+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.15-14.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/procps-ng@3.3.15-14.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2018-19211",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a \"dubious character `*' in name or alias field\" detection.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-19211"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-19211"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1643754"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19211"
},
{
"url": "https://ubuntu.com/security/notices/USN-5477-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-19211"
}
],
"published": "2018-11-12T19:29:00+00:00",
"updated": "2024-11-21T03:57:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-20225",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"cwes": [
20
],
"description": "An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-20225"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-20225"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1835736"
},
{
"url": "https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html"
},
{
"url": "https://lists.apache.org/thread.html/rb1adce798445facd032870d644eb39c4baaf9c4a7dd5477d12bb6ab2%40%3Cgithub.arrow.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20225"
},
{
"url": "https://pip.pypa.io/en/stable/news/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20225"
}
],
"published": "2020-05-08T18:15:10+00:00",
"updated": "2024-11-21T04:01:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable. "
}
},
{
"id": "CVE-2018-20657",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
772
],
"description": "The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, has a memory leak via a crafted string, leading to a denial of service (memory consumption), as demonstrated by cxxfilt, a related issue to CVE-2018-12698.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-20657"
},
{
"url": "http://www.securityfocus.com/bid/106444"
},
{
"url": "https://access.redhat.com/errata/RHSA-2019:3352"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-20657"
},
{
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88539"
},
{
"url": "https://linux.oracle.com/cve/CVE-2018-20657.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2019-3352.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20657"
},
{
"url": "https://support.f5.com/csp/article/K62602089"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20657"
}
],
"published": "2019-01-02T14:29:00+00:00",
"updated": "2024-11-21T04:01:56+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2018-20839",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"description": "systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2018-20839"
},
{
"url": "http://www.securityfocus.com/bid/108389"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2018-20839"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993"
},
{
"url": "https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f"
},
{
"url": "https://github.com/systemd/systemd/pull/12378"
},
{
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20839"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190530-0002/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20839"
}
],
"published": "2019-05-17T04:29:00+00:00",
"updated": "2025-05-05T14:14:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-12904",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"cwes": [
668
],
"description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.) NOTE: the vendor's position is that the issue report cannot be validated because there is no description of an attack",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-12904"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-12904"
},
{
"url": "https://dev.gnupg.org/T4541"
},
{
"url": "https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020"
},
{
"url": "https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762"
},
{
"url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"
},
{
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2019-July/004760.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12904"
},
{
"url": "https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12904.html"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-12904"
}
],
"published": "2019-06-20T00:15:10+00:00",
"updated": "2024-11-21T04:23:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.8.5-7.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2019-14250",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190,
787
],
"description": "An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.32. simple_object_elf_match in simple-object-elf.c does not check for a zero shstrndx value, leading to an integer overflow and resultant heap-based buffer overflow.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-14250"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00056.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00057.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00058.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00078.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00004.html"
},
{
"url": "http://www.securityfocus.com/bid/109354"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-14250"
},
{
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=90924"
},
{
"url": "https://gcc.gnu.org/ml/gcc-patches/2019-07/msg01003.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14250"
},
{
"url": "https://security.gentoo.org/glsa/202007-39"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190822-0002/"
},
{
"url": "https://ubuntu.com/security/notices/USN-4326-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-4336-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-4336-2"
},
{
"url": "https://usn.ubuntu.com/4326-1/"
},
{
"url": "https://usn.ubuntu.com/4336-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-14250"
}
],
"published": "2019-07-24T04:15:12+00:00",
"updated": "2024-11-21T04:26:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2019-16866",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
755,
908
],
"description": "Unbound before 1.9.4 accesses uninitialized memory, which allows remote attackers to trigger a crash via a crafted NOTIFY query. The source IP address of the query must match an access-control rule.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-16866"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-16866"
},
{
"url": "https://github.com/NLnetLabs/unbound/blob/release-1.9.4/doc/Changelog"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E65NCWZZB2D75ZIYWPXKMVGSGNYW4JMC/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MLRHE7TQFAOV4MB2ELTOGESZYUL65NUJ/"
},
{
"url": "https://nlnetlabs.nl/downloads/unbound/CVE-2019-16866.txt"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16866"
},
{
"url": "https://seclists.org/bugtraq/2019/Oct/23"
},
{
"url": "https://ubuntu.com/security/notices/USN-4149-1"
},
{
"url": "https://usn.ubuntu.com/4149-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16866"
},
{
"url": "https://www.debian.org/security/2019/dsa-4544"
}
],
"published": "2019-10-03T19:15:09+00:00",
"updated": "2024-11-21T04:31:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-19244",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "sqlite3Select in select.c in SQLite 3.30.1 allows a crash if a sub-select uses both DISTINCT and window functions, and also has certain ORDER BY usage.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-19244"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-19244"
},
{
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"url": "https://github.com/sqlite/sqlite/commit/e59c562b3f6894f84c715772c4b116d7b5c01348"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19244"
},
{
"url": "https://ubuntu.com/security/notices/USN-4205-1"
},
{
"url": "https://usn.ubuntu.com/4205-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-19244"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2020.html"
}
],
"published": "2019-11-25T20:15:11+00:00",
"updated": "2024-11-21T04:34:24+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2019-8905",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 3.6,
"severity": "info",
"method": "CVSSv2",
"vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
125
],
"description": "do_core_note in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to file_printable, a different vulnerability than CVE-2018-10360.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-8905"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html"
},
{
"url": "http://www.securityfocus.com/bid/107137"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-8905"
},
{
"url": "https://bugs.astron.com/view.php?id=63"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2019/02/msg00044.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8905"
},
{
"url": "https://ubuntu.com/security/notices/USN-3911-1"
},
{
"url": "https://usn.ubuntu.com/3911-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8905"
}
],
"published": "2019-02-18T17:29:00+00:00",
"updated": "2024-11-21T04:50:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "5.33-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable.\nFor python:"
}
},
{
"id": "CVE-2019-8906",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 3.6,
"severity": "info",
"method": "CVSSv2",
"vector": "AV:L/AC:L/Au:N/C:P/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-8906"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-8906"
},
{
"url": "https://bugs.astron.com/view.php?id=64"
},
{
"url": "https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8906"
},
{
"url": "https://support.apple.com/kb/HT209599"
},
{
"url": "https://support.apple.com/kb/HT209600"
},
{
"url": "https://support.apple.com/kb/HT209601"
},
{
"url": "https://support.apple.com/kb/HT209602"
},
{
"url": "https://ubuntu.com/security/notices/USN-3911-1"
},
{
"url": "https://usn.ubuntu.com/3911-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-8906"
}
],
"published": "2019-02-18T17:29:01+00:00",
"updated": "2024-11-21T04:50:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "5.33-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/file-libs@5.33-27.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable.\nFor python:"
}
},
{
"id": "CVE-2019-9674",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400
],
"description": "Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9674"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9674"
},
{
"url": "https://bugs.python.org/issue36260"
},
{
"url": "https://bugs.python.org/issue36462"
},
{
"url": "https://github.com/python/cpython/blob/master/Lib/zipfile.py"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9674"
},
{
"url": "https://python-security.readthedocs.io/security.html#archives-and-zip-bomb"
},
{
"url": "https://security.netapp.com/advisory/ntap-20200221-0003/"
},
{
"url": "https://ubuntu.com/security/notices/USN-4428-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-4754-3"
},
{
"url": "https://ubuntu.com/security/notices/USN-6891-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7212-1"
},
{
"url": "https://usn.ubuntu.com/4428-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9674"
},
{
"url": "https://www.python.org/news/security/"
}
],
"published": "2020-02-04T15:15:11+00:00",
"updated": "2025-12-31T00:55:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2019-9923",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9923"
},
{
"url": "http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html"
},
{
"url": "http://savannah.gnu.org/bugs/?55369"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9923"
},
{
"url": "https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241"
},
{
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9923"
},
{
"url": "https://ubuntu.com/security/notices/USN-4692-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9923"
}
],
"published": "2019-03-22T08:29:00+00:00",
"updated": "2025-08-06T22:15:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-9936",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "In SQLite 3.27.2, running fts5 prefix queries inside a transaction could trigger a heap-based buffer over-read in fts5HashEntrySort in sqlite3.c, which may lead to an information leak. This is related to ext/fts5/fts5_hash.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9936"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html"
},
{
"url": "http://www.securityfocus.com/bid/107562"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9936"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9936"
},
{
"url": "https://security.gentoo.org/glsa/201908-09"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190416-0005/"
},
{
"url": "https://sqlite.org/src/info/b3fa58dd7403dbd4"
},
{
"url": "https://ubuntu.com/security/notices/USN-4019-1"
},
{
"url": "https://usn.ubuntu.com/4019-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9936"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114382.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114394.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114382.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114394.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
}
],
"published": "2019-03-22T08:29:00+00:00",
"updated": "2024-11-21T04:52:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2019-9937",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "In SQLite 3.27.2, interleaving reads and writes in a single transaction with an fts5 virtual table will lead to a NULL Pointer Dereference in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2019-9937"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00026.html"
},
{
"url": "http://www.securityfocus.com/bid/107562"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2019-9937"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2020/08/msg00037.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXD2GYJVTDGEQPUNMMMC5TB7MQXOBBMO/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N66U5PY5UJU4XBFZJH7QNKIDNAVIB4OP/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9937"
},
{
"url": "https://security.gentoo.org/glsa/201908-09"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190416-0005/"
},
{
"url": "https://sqlite.org/src/info/45c73deb440496e8"
},
{
"url": "https://ubuntu.com/security/notices/USN-4019-1"
},
{
"url": "https://usn.ubuntu.com/4019-1/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9937"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114383.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users%40mailinglists.sqlite.org/msg114393.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114383.html"
},
{
"url": "https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg114393.html"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"url": "https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"
}
],
"published": "2019-03-22T08:29:00+00:00",
"updated": "2024-11-21T04:52:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2020-19185",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19185"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19185"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc1.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19185"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19185"
}
],
"published": "2023-08-22T19:15:57+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19186",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19186"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19186"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc2.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19186"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19186"
}
],
"published": "2023-08-22T19:15:58+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19187",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19187"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19187"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc3.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19187"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19187"
}
],
"published": "2023-08-22T19:15:59+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19188",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19188"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19188"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc4.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19188"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19188"
}
],
"published": "2023-08-22T19:16:00+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2020-19189",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19189"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19189"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc5.md"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00033.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19189"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://ubuntu.com/security/notices/USN-6451-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19189"
}
],
"published": "2023-08-22T19:16:01+00:00",
"updated": "2024-11-21T05:09:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-19190",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-19190"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/10"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/11"
},
{
"url": "http://seclists.org/fulldisclosure/2023/Dec/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-19190"
},
{
"url": "https://github.com/zjuchenyuan/fuzzpoc/blob/master/infotocap_poc6.md"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19190"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231006-0005/"
},
{
"url": "https://support.apple.com/kb/HT214036"
},
{
"url": "https://support.apple.com/kb/HT214037"
},
{
"url": "https://support.apple.com/kb/HT214038"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-19190"
}
],
"published": "2023-08-22T19:16:01+00:00",
"updated": "2024-11-21T05:09:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2020-35512",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.2,
"severity": "high",
"method": "CVSSv2",
"vector": "AV:L/AC:L/Au:N/C:C/I:C/A:C"
},
{
"source": {
"name": "nvd"
},
"score": 7.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
416
],
"description": "A use-after-free flaw was found in D-Bus Development branch <= 1.13.16, dbus-1.12.x stable branch <= 1.12.18, and dbus-1.10.x and older branches <= 1.10.30 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2020-35512"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2020-35512"
},
{
"url": "https://bugs.gentoo.org/755392"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909101"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/2b7948ef907669e844b52c4fa2268d6e3162a70c"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/dc94fe3d31adf72259adc31f343537151a6c0bdd"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/commit/f3b2574f0c9faa32a59efec905921f7ef4438a60"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305"
},
{
"url": "https://gitlab.freedesktop.org/dbus/dbus/-/issues/305#note_829128"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35512"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2020-35512"
},
{
"url": "https://ubuntu.com/security/notices/USN-5244-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5244-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2020-35512"
}
],
"published": "2021-02-15T17:15:12+00:00",
"updated": "2024-11-21T05:27:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.12.8-27.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/dbus-common@1.12.8-27.el8_10?arch=noarch&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/dbus-daemon@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/dbus-libs@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/dbus-tools@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/dbus@1.12.8-27.el8_10?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-20193",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
401,
125
],
"description": "A flaw was found in the src/list.c of tar 1.33 and earlier. This flaw allows an attacker who can submit a crafted input file to tar to cause uncontrolled consumption of memory. The highest threat from this vulnerability is to system availability.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-20193"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-20193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1917565"
},
{
"url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20193"
},
{
"url": "https://savannah.gnu.org/bugs/?59897"
},
{
"url": "https://security.gentoo.org/glsa/202105-29"
},
{
"url": "https://ubuntu.com/security/notices/USN-5329-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-20193"
}
],
"published": "2021-03-26T17:15:12+00:00",
"updated": "2025-05-05T14:15:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-24032",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 1.9,
"severity": "info",
"method": "CVSSv2",
"vector": "AV:L/AC:M/Au:N/C:P/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
277,
276
],
"description": "Beginning in v1.4.1 and prior to v1.4.9, due to an incomplete fix for CVE-2021-24031, the Zstandard command-line utility created output files with default permissions and restricted those permissions immediately afterwards. Output files could therefore momentarily be readable or writable to unintended parties.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-24032"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-24032"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982519"
},
{
"url": "https://github.com/facebook/zstd/issues/2491"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24032"
},
{
"url": "https://ubuntu.com/security/notices/USN-4760-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5720-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-24032"
},
{
"url": "https://www.facebook.com/security/advisories/cve-2021-24032"
}
],
"published": "2021-03-04T21:15:12+00:00",
"updated": "2024-11-21T05:52:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.4.4-1.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-31879",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.8,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
601
],
"description": "GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-31879"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-31879"
},
{
"url": "https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31879"
},
{
"url": "https://savannah.gnu.org/bugs/?56909"
},
{
"url": "https://security.netapp.com/advisory/ntap-20210618-0002/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-31879"
}
],
"published": "2021-04-29T05:15:08+00:00",
"updated": "2024-11-21T06:06:25+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.19.5-12.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-39537",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 8.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
787
],
"description": "An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-39537"
},
{
"url": "http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/28"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/41"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/43"
},
{
"url": "http://seclists.org/fulldisclosure/2022/Oct/45"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-39537"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39537"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230427-0012/"
},
{
"url": "https://support.apple.com/kb/HT213443"
},
{
"url": "https://support.apple.com/kb/HT213444"
},
{
"url": "https://support.apple.com/kb/HT213488"
},
{
"url": "https://ubuntu.com/security/notices/USN-5477-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39537"
}
],
"published": "2021-09-20T16:15:12+00:00",
"updated": "2024-11-21T06:19:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-3997",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "A flaw was found in systemd. An uncontrolled recursion in systemd-tmpfiles may lead to a denial of service at boot time when too many nested directories are created in /tmp.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-3997"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-3997"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2024639"
},
{
"url": "https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3997"
},
{
"url": "https://security.gentoo.org/glsa/202305-15"
},
{
"url": "https://ubuntu.com/security/notices/USN-5226-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-3997"
},
{
"url": "https://www.openwall.com/lists/oss-security/2022/01/10/2"
}
],
"published": "2022-08-23T20:15:08+00:00",
"updated": "2024-11-21T06:23:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2021-4209",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2021-4209"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2021-4209"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2044156"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1306"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/merge_requests/1503"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4209"
},
{
"url": "https://security.netapp.com/advisory/ntap-20220915-0005/"
},
{
"url": "https://ubuntu.com/security/notices/USN-5550-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5750-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2021-4209"
}
],
"published": "2022-08-24T16:15:09+00:00",
"updated": "2024-11-21T06:37:09+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.16-8.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2022-0391",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "bitnami"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
74
],
"description": "A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\r' and '\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-0391"
},
{
"url": "https://access.redhat.com/errata/RHSA-2022:6457"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-0391"
},
{
"url": "https://bugs.python.org/issue43882"
},
{
"url": "https://bugzilla.redhat.com/2047376"
},
{
"url": "https://bugzilla.redhat.com/2075390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995162"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1995234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2006792"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2032569"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2036020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2047376"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3733"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3737"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4189"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43818"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0391"
},
{
"url": "https://errata.almalinux.org/8/ALSA-2022-6457.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2022:1821"
},
{
"url": "https://linux.oracle.com/cve/CVE-2022-0391.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3550.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0391"
},
{
"url": "https://security.gentoo.org/glsa/202305-02"
},
{
"url": "https://security.netapp.com/advisory/ntap-20220225-0009/"
},
{
"url": "https://ubuntu.com/security/notices/USN-5342-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-5342-2"
},
{
"url": "https://ubuntu.com/security/notices/USN-6891-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-0391"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"published": "2022-02-09T23:15:16+00:00",
"updated": "2025-12-17T21:15:52+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
"versions": [
{
"version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2022-27943",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv2",
"vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
674
],
"description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-27943"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-27943"
},
{
"url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039"
},
{
"url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371"
},
{
"url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79"
},
{
"url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead"
},
{
"url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27943"
}
],
"published": "2022-03-26T13:15:07+00:00",
"updated": "2024-11-21T06:56:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.5.0-28.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libgcc@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libstdc%2B%2B@8.5.0-28.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2022-3219",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
787
],
"description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-3219"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-3219"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010"
},
{
"url": "https://dev.gnupg.org/D556"
},
{
"url": "https://dev.gnupg.org/T5993"
},
{
"url": "https://marc.info/?l=oss-security&m=165696590211434&w=4"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3219"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230324-0001/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-3219"
}
],
"published": "2023-02-23T20:15:12+00:00",
"updated": "2025-03-12T21:15:38+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2022-41409",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-41409"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-41409"
},
{
"url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35"
},
{
"url": "https://github.com/PCRE2Project/pcre2/issues/141"
},
{
"url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-41409"
}
],
"published": "2023-07-18T14:15:12+00:00",
"updated": "2024-11-21T07:23:10+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "10.32-3.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/pcre2@10.32-3.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2022-4899",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400
],
"description": "A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2022-4899"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:1141"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2022-4899"
},
{
"url": "https://bugzilla.redhat.com/2179864"
},
{
"url": "https://bugzilla.redhat.com/2188109"
},
{
"url": "https://bugzilla.redhat.com/2188113"
},
{
"url": "https://bugzilla.redhat.com/2188115"
},
{
"url": "https://bugzilla.redhat.com/2188116"
},
{
"url": "https://bugzilla.redhat.com/2188117"
},
{
"url": "https://bugzilla.redhat.com/2188118"
},
{
"url": "https://bugzilla.redhat.com/2188119"
},
{
"url": "https://bugzilla.redhat.com/2188120"
},
{
"url": "https://bugzilla.redhat.com/2188121"
},
{
"url": "https://bugzilla.redhat.com/2188122"
},
{
"url": "https://bugzilla.redhat.com/2188123"
},
{
"url": "https://bugzilla.redhat.com/2188124"
},
{
"url": "https://bugzilla.redhat.com/2188125"
},
{
"url": "https://bugzilla.redhat.com/2188127"
},
{
"url": "https://bugzilla.redhat.com/2188128"
},
{
"url": "https://bugzilla.redhat.com/2188129"
},
{
"url": "https://bugzilla.redhat.com/2188130"
},
{
"url": "https://bugzilla.redhat.com/2188131"
},
{
"url": "https://bugzilla.redhat.com/2188132"
},
{
"url": "https://bugzilla.redhat.com/2224211"
},
{
"url": "https://bugzilla.redhat.com/2224212"
},
{
"url": "https://bugzilla.redhat.com/2224213"
},
{
"url": "https://bugzilla.redhat.com/2224214"
},
{
"url": "https://bugzilla.redhat.com/2224215"
},
{
"url": "https://bugzilla.redhat.com/2224216"
},
{
"url": "https://bugzilla.redhat.com/2224217"
},
{
"url": "https://bugzilla.redhat.com/2224218"
},
{
"url": "https://bugzilla.redhat.com/2224219"
},
{
"url": "https://bugzilla.redhat.com/2224220"
},
{
"url": "https://bugzilla.redhat.com/2224221"
},
{
"url": "https://bugzilla.redhat.com/2224222"
},
{
"url": "https://bugzilla.redhat.com/2245014"
},
{
"url": "https://bugzilla.redhat.com/2245015"
},
{
"url": "https://bugzilla.redhat.com/2245016"
},
{
"url": "https://bugzilla.redhat.com/2245017"
},
{
"url": "https://bugzilla.redhat.com/2245018"
},
{
"url": "https://bugzilla.redhat.com/2245019"
},
{
"url": "https://bugzilla.redhat.com/2245020"
},
{
"url": "https://bugzilla.redhat.com/2245021"
},
{
"url": "https://bugzilla.redhat.com/2245022"
},
{
"url": "https://bugzilla.redhat.com/2245023"
},
{
"url": "https://bugzilla.redhat.com/2245024"
},
{
"url": "https://bugzilla.redhat.com/2245026"
},
{
"url": "https://bugzilla.redhat.com/2245027"
},
{
"url": "https://bugzilla.redhat.com/2245028"
},
{
"url": "https://bugzilla.redhat.com/2245029"
},
{
"url": "https://bugzilla.redhat.com/2245030"
},
{
"url": "https://bugzilla.redhat.com/2245031"
},
{
"url": "https://bugzilla.redhat.com/2245032"
},
{
"url": "https://bugzilla.redhat.com/2245033"
},
{
"url": "https://bugzilla.redhat.com/2245034"
},
{
"url": "https://bugzilla.redhat.com/2258771"
},
{
"url": "https://bugzilla.redhat.com/2258772"
},
{
"url": "https://bugzilla.redhat.com/2258773"
},
{
"url": "https://bugzilla.redhat.com/2258774"
},
{
"url": "https://bugzilla.redhat.com/2258775"
},
{
"url": "https://bugzilla.redhat.com/2258776"
},
{
"url": "https://bugzilla.redhat.com/2258777"
},
{
"url": "https://bugzilla.redhat.com/2258778"
},
{
"url": "https://bugzilla.redhat.com/2258779"
},
{
"url": "https://bugzilla.redhat.com/2258780"
},
{
"url": "https://bugzilla.redhat.com/2258781"
},
{
"url": "https://bugzilla.redhat.com/2258782"
},
{
"url": "https://bugzilla.redhat.com/2258783"
},
{
"url": "https://bugzilla.redhat.com/2258784"
},
{
"url": "https://bugzilla.redhat.com/2258785"
},
{
"url": "https://bugzilla.redhat.com/2258787"
},
{
"url": "https://bugzilla.redhat.com/2258788"
},
{
"url": "https://bugzilla.redhat.com/2258789"
},
{
"url": "https://bugzilla.redhat.com/2258790"
},
{
"url": "https://bugzilla.redhat.com/2258791"
},
{
"url": "https://bugzilla.redhat.com/2258792"
},
{
"url": "https://bugzilla.redhat.com/2258793"
},
{
"url": "https://bugzilla.redhat.com/2258794"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2179864"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188109"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188113"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188115"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188116"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188117"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188118"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188119"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188120"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188121"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188122"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188123"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188124"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188125"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188127"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188128"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188129"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188130"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188131"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2188132"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224211"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224212"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224213"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224214"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224215"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224216"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224217"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224219"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2224222"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245015"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245017"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245018"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245019"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245021"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245022"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245023"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245024"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245026"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245027"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245028"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245029"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245030"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245031"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245032"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245033"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245034"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258771"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258772"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258773"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258774"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258775"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258777"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258778"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258779"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258780"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258781"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258782"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258783"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258784"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258785"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258787"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258788"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258789"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258790"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258791"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258792"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258793"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258794"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4899"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21911"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21919"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21920"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21929"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21933"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21935"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21940"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21945"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21946"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21947"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21953"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21955"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21962"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21972"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21976"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21977"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21980"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22005"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22007"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22008"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22032"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22033"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22038"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22046"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22048"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22054"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22056"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22057"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22058"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22059"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22064"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22065"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22066"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22068"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22070"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22078"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22079"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22084"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22092"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22097"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22103"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22104"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22110"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22111"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22112"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22113"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22114"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22115"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20960"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20961"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20962"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20963"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20964"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20965"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20966"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20967"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20968"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20969"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20970"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20971"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20972"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20973"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20974"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20976"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20977"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20978"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20981"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20982"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20983"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20984"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20985"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20993"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21049"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21050"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21051"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21052"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21055"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21056"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21057"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21061"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21137"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21200"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-1141.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:0894"
},
{
"url": "https://github.com/facebook/zstd"
},
{
"url": "https://github.com/facebook/zstd/issues/3200"
},
{
"url": "https://github.com/facebook/zstd/pull/3220"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/zstd/PYSEC-2023-121.yaml"
},
{
"url": "https://github.com/sergey-dryabzhinsky/python-zstd/commit/c8a619aebdbd6b838fbfef6e19325a70f631a4c6"
},
{
"url": "https://linux.oracle.com/cve/CVE-2022-4899.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-1141.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4899"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230725-0005"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230725-0005/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2022-4899"
}
],
"published": "2023-03-31T20:15:07+00:00",
"updated": "2025-02-18T18:15:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.4.4-1.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libzstd@1.4.4-1.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-0464",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "A security vulnerability has been identified in all supported versions\n\nof OpenSSL related to the verification of X.509 certificate chains\nthat include policy constraints. Attackers may be able to exploit this\nvulnerability by creating a malicious certificate chain that triggers\nexponential use of computational resources, leading to a denial-of-service\n(DoS) attack on affected systems.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-0464"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:3722"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0464"
},
{
"url": "https://bugzilla.redhat.com/2181082"
},
{
"url": "https://bugzilla.redhat.com/2182561"
},
{
"url": "https://bugzilla.redhat.com/2182565"
},
{
"url": "https://bugzilla.redhat.com/2188461"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-0464.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0464"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230406-0006/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6039-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.couchbase.com/alerts/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0464"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230322.txt"
}
],
"published": "2023-03-22T17:15:13+00:00",
"updated": "2025-05-05T16:15:26+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-0465",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "Applications that use a non-default option when verifying certificates may be\nvulnerable to an attack from a malicious CA to circumvent certain checks.\n\nInvalid certificate policies in leaf certificates are silently ignored by\nOpenSSL and other certificate policy checks are skipped for that certificate.\nA malicious CA could use this to deliberately assert invalid certificate policies\nin order to circumvent policy checking on the certificate altogether.\n\nPolicy processing is disabled by default but can be enabled by passing\nthe `-policy' argument to the command line utilities or by calling the\n`X509_VERIFY_PARAM_set1_policies()' function.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-0465"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:3722"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0465"
},
{
"url": "https://bugzilla.redhat.com/2181082"
},
{
"url": "https://bugzilla.redhat.com/2182561"
},
{
"url": "https://bugzilla.redhat.com/2182565"
},
{
"url": "https://bugzilla.redhat.com/2188461"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=10325176f3d3e98c6e2b3bf5ab1e3b334de6947a"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=1dd43e0709fece299b15208f36cc7c76209ba0bb"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=facfb1ab745646e97a1920977ae4a9965ea61d5c"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-0465.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0465"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6039-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0465"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230328.txt"
}
],
"published": "2023-03-28T15:15:06+00:00",
"updated": "2025-02-18T21:15:13+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-0466",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
295
],
"description": "The function X509_VERIFY_PARAM_add0_policy() is documented to\nimplicitly enable the certificate policy check when doing certificate\nverification. However the implementation of the function does not\nenable the check which allows certificates with invalid or incorrect\npolicies to pass the certificate verification.\n\nAs suddenly enabling the policy check could break existing deployments it was\ndecided to keep the existing behavior of the X509_VERIFY_PARAM_add0_policy()\nfunction.\n\nInstead the applications that require OpenSSL to perform certificate\npolicy check need to use X509_VERIFY_PARAM_set1_policies() or explicitly\nenable the policy check by calling X509_VERIFY_PARAM_set_flags() with\nthe X509_V_FLAG_POLICY_CHECK flag argument.\n\nCertificate policy checks are disabled by default in OpenSSL and are not\ncommonly used by applications.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-0466"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/09/28/4"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:3722"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-0466"
},
{
"url": "https://bugzilla.redhat.com/2181082"
},
{
"url": "https://bugzilla.redhat.com/2182561"
},
{
"url": "https://bugzilla.redhat.com/2182565"
},
{
"url": "https://bugzilla.redhat.com/2188461"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-3722.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=51e8a84ce742db0f6c70510d0159dad8f7825908"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=73398dea26de9899fb4baa94098ad0a61f435c72"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=fc814a30fc4f0bc54fcea7d9a7462f5457aab061"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-0466.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-3722.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0466"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230414-0001/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6039-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-0466"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230328.txt"
}
],
"published": "2023-03-28T15:15:06+00:00",
"updated": "2025-02-19T18:15:22+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-2650",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
770
],
"description": "Issue summary: Processing some specially crafted ASN.1 object identifiers or\ndata containing them may be very slow.\n\nImpact summary: Applications that use OBJ_obj2txt() directly, or use any of\nthe OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message\nsize limit may experience notable to very long delays when processing those\nmessages, which may lead to a Denial of Service.\n\nAn OBJECT IDENTIFIER is composed of a series of numbers - sub-identifiers -\nmost of which have no size limit. OBJ_obj2txt() may be used to translate\nan ASN.1 OBJECT IDENTIFIER given in DER encoding form (using the OpenSSL\ntype ASN1_OBJECT) to its canonical numeric text form, which are the\nsub-identifiers of the OBJECT IDENTIFIER in decimal form, separated by\nperiods.\n\nWhen one of the sub-identifiers in the OBJECT IDENTIFIER is very large\n(these are sizes that are seen as absurdly large, taking up tens or hundreds\nof KiBs), the translation to a decimal number in text may take a very long\ntime. The time complexity is O(n^2) with 'n' being the size of the\nsub-identifiers in bytes (*).\n\nWith OpenSSL 3.0, support to fetch cryptographic algorithms using names /\nidentifiers in string form was introduced. This includes using OBJECT\nIDENTIFIERs in canonical numeric text form as identifiers for fetching\nalgorithms.\n\nSuch OBJECT IDENTIFIERs may be received through the ASN.1 structure\nAlgorithmIdentifier, which is commonly used in multiple protocols to specify\nwhat cryptographic algorithm should be used to sign or verify, encrypt or\ndecrypt, or digest passed data.\n\nApplications that call OBJ_obj2txt() directly with untrusted data are\naffected, with any version of OpenSSL. If the use is for the mere purpose\nof display, the severity is considered low.\n\nIn OpenSSL 3.0 and newer, this affects the subsystems OCSP, PKCS7/SMIME,\nCMS, CMP/CRMF or TS. It also impacts anything that processes X.509\ncertificates, including simple things like verifying its signature.\n\nThe impact on TLS is relatively low, because all versions of OpenSSL have a\n100KiB limit on the peer's certificate chain. Additionally, this only\nimpacts clients, or servers that have explicitly enabled client\nauthentication.\n\nIn OpenSSL 1.1.1 and 1.0.2, this only affects displaying diverse objects,\nsuch as X.509 certificates. This is assumed to not happen in such a way\nthat it would cause a Denial of Service, so these versions are considered\nnot affected by this issue in such a way that it would be cause for concern,\nand the severity is therefore considered low.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-2650"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/05/30/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:6330"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-2650"
},
{
"url": "https://bugzilla.redhat.com/1858038"
},
{
"url": "https://bugzilla.redhat.com/2207947"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-6330.html"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=423a2bc737a908ad0c77bda470b2b59dc879936b"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=853c5e56ee0b8650c73140816bb8b91d6163422c"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9e209944b35cf82368071f160a744b6178f9b098"
},
{
"url": "https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=db779b0e10b047f2585615e0b8f2acdf21f8544a"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-2650.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-6330.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2650"
},
{
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0009"
},
{
"url": "https://security.gentoo.org/glsa/202402-08"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230703-0001/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231027-0009/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6119-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6188-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6672-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-2650"
},
{
"url": "https://www.debian.org/security/2023/dsa-5417"
},
{
"url": "https://www.openssl.org/news/secadv/20230530.txt"
}
],
"published": "2023-05-30T14:15:09+00:00",
"updated": "2025-03-19T16:15:21+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-27534",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 8.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
22
],
"description": "A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /~2/foo while accessing a server with a specific user.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-27534"
},
{
"url": "https://access.redhat.com/errata/RHSA-2023:6679"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-27534"
},
{
"url": "https://bugzilla.redhat.com/2179062"
},
{
"url": "https://bugzilla.redhat.com/2179069"
},
{
"url": "https://bugzilla.redhat.com/2179092"
},
{
"url": "https://bugzilla.redhat.com/2179103"
},
{
"url": "https://curl.se/docs/CVE-2023-27534.html"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2023-6679.html"
},
{
"url": "https://hackerone.com/reports/1892351"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-27534.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2023-6679.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27534"
},
{
"url": "https://security.gentoo.org/glsa/202310-12"
},
{
"url": "https://security.netapp.com/advisory/ntap-20230420-0012/"
},
{
"url": "https://ubuntu.com/security/notices/USN-5964-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-27534"
}
],
"published": "2023-03-30T20:15:07+00:00",
"updated": "2025-04-23T17:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-29499",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-29499"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-29499"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211828"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2794"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-29499.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-29499"
},
{
"url": "https://security.gentoo.org/glsa/202311-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231103-0001/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-29499"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T07:57:10+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-32611",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-32611"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-32611"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211829"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2797"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-32611.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32611"
},
{
"url": "https://security.gentoo.org/glsa/202311-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231027-0005/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32611"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T08:03:41+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-32636",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400,
502
],
"description": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-32636"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-32636"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841"
},
{
"url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-32636.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32636"
},
{
"url": "https://security.netapp.com/advisory/ntap-20231110-0002/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32636"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T08:03:44+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-32665",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400,
502
],
"description": "A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-32665"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2528"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-32665"
},
{
"url": "https://bugzilla.redhat.com/2211827"
},
{
"url": "https://bugzilla.redhat.com/2211828"
},
{
"url": "https://bugzilla.redhat.com/2211829"
},
{
"url": "https://bugzilla.redhat.com/2211833"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2211827"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2528.html"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2121"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-32665.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2528.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00030.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32665"
},
{
"url": "https://security.gentoo.org/glsa/202311-18"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240426-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6165-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-32665"
}
],
"published": "2023-09-14T20:15:09+00:00",
"updated": "2024-11-21T08:03:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2023-39804",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-39804"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-39804"
},
{
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079"
},
{
"url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4"
},
{
"url": "https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39804"
},
{
"url": "https://ubuntu.com/security/notices/USN-6543-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-39804"
}
],
"published": "2024-03-27T04:15:08+00:00",
"updated": "2025-11-04T19:15:55+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-4156",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-4156"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-4156"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930"
},
{
"url": "https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212"
},
{
"url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00000.html"
},
{
"url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00023.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4156"
},
{
"url": "https://ubuntu.com/security/notices/USN-6373-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-4156"
}
],
"published": "2023-09-25T18:15:11+00:00",
"updated": "2024-11-21T08:34:30+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.2.1-4.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gawk@4.2.1-4.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2023-45322",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
416
],
"description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-45322"
},
{
"url": "http://www.openwall.com/lists/oss-security/2023/10/06/5"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-45322"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/344"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/583"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45322"
}
],
"published": "2023-10-06T22:15:11+00:00",
"updated": "2025-11-03T21:16:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2023-45803",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
200
],
"description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-45803"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:2132"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-45803"
},
{
"url": "https://bugzilla.redhat.com/2246840"
},
{
"url": "https://bugzilla.redhat.com/2257028"
},
{
"url": "https://bugzilla.redhat.com/2257854"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1983596"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1989575"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132867"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132868"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2132872"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2228743"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237773"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237777"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2237778"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2244340"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246840"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253193"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253330"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2254210"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2262272"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25091"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33198"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34558"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2879"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2880"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41715"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29409"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39318"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39319"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39321"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39322"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-39326"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45287"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-48795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23650"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-2132.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:2988"
},
{
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9"
},
{
"url": "https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/1.26.18"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2023-45803.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-2988.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803"
},
{
"url": "https://ubuntu.com/security/notices/USN-6473-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6473-2"
},
{
"url": "https://ubuntu.com/security/notices/USN-7762-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-45803"
},
{
"url": "https://www.rfc-editor.org/rfc/rfc9110.html#name-get"
}
],
"published": "2023-10-17T20:15:10+00:00",
"updated": "2025-11-03T22:16:28+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2023-50495",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2023-50495"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2023-50495"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240119-0008/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6684-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2023-50495"
}
],
"published": "2023-12-12T15:15:07+00:00",
"updated": "2025-11-04T19:16:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "6.1-10.20180224.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-base@6.1-10.20180224.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/ncurses-libs@6.1-10.20180224.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-0232",
"ratings": [
{
"source": {
"name": "bitnami"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
416
],
"description": "A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-0232"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-0232"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0232"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240315-0007/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0232"
}
],
"published": "2024-01-16T14:15:48+00:00",
"updated": "2024-11-21T08:46:06+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-0397",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "bitnami"
},
"score": 7.4,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
362
],
"description": "A defect was discovered in the Python \u201cssl\u201d module where there is a memory\nrace condition with the ssl.SSLContext methods \u201ccert_store_stats()\u201d and\n\u201cget_ca_certs()\u201d. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-0397"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/06/17/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-0397"
},
{
"url": "https://github.com/python/cpython/commit/01c37f1d0714f5822d34063ca7180b595abf589d"
},
{
"url": "https://github.com/python/cpython/commit/29c97287d205bf2f410f4895ebce3f43b5160524"
},
{
"url": "https://github.com/python/cpython/commit/37324b421b72b7bc9934e27aba85d48d4773002e"
},
{
"url": "https://github.com/python/cpython/commit/542f3272f56f31ed04e74c40635a913fbc12d286"
},
{
"url": "https://github.com/python/cpython/commit/b228655c227b2ca298a8ffac44d14ce3d22f6faa"
},
{
"url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
},
{
"url": "https://github.com/python/cpython/commit/bce693111bff906ccf9281c22371331aaff766ab"
},
{
"url": "https://github.com/python/cpython/issues/114572"
},
{
"url": "https://github.com/python/cpython/pull/114573"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BMAK5BCGKYWNJOACVUSLUF6SFGBIM4VP/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250411-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6928-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0397"
}
],
"published": "2024-06-17T16:15:10+00:00",
"updated": "2025-11-03T22:16:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
"versions": [
{
"version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
}
]
},
{
"id": "CVE-2024-0727",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-0727"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/03/11/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9088"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-0727"
},
{
"url": "https://bugzilla.redhat.com/2257571"
},
{
"url": "https://bugzilla.redhat.com/2258502"
},
{
"url": "https://bugzilla.redhat.com/2259944"
},
{
"url": "https://bugzilla.redhat.com/2284243"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2257571"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258502"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2259944"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2284243"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6129"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6237"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0727"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1298"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9088.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9088"
},
{
"url": "https://github.com/alexcrichton/openssl-src-rs/commit/add20f73b6b42be7451af2e1044d4e0e778992b2"
},
{
"url": "https://github.com/github/advisory-database/pull/3472"
},
{
"url": "https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2"
},
{
"url": "https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844a"
},
{
"url": "https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c"
},
{
"url": "https://github.com/openssl/openssl/pull/23362"
},
{
"url": "https://github.com/pyca/cryptography/commit/3519591d255d4506fbcd0d04037d45271903c64d"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-0727.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9088.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240208-0006"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240208-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6622-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6632-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6709-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7018-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0727"
},
{
"url": "https://www.openssl.org/news/secadv/20240125.txt"
}
],
"published": "2024-01-26T09:15:07+00:00",
"updated": "2025-11-03T22:16:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any Python code. That assures that the vulnerable code path in the affected library is not reachable. The Python libraries are only used for diagnostics."
}
},
{
"id": "CVE-2024-10524",
"ratings": [
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L"
}
],
"cwes": [
918
],
"description": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-10524"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/11/18/6"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-10524"
},
{
"url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778"
},
{
"url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10524"
},
{
"url": "https://seclists.org/oss-sec/2024/q4/107"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250321-0007/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-10524"
}
],
"published": "2024-11-19T15:15:06+00:00",
"updated": "2025-03-21T18:15:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.19.5-12.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/wget@1.19.5-12.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-11053",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-11053"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/12/11/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:1671"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-11053"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/2294676"
},
{
"url": "https://bugzilla.redhat.com/2301888"
},
{
"url": "https://bugzilla.redhat.com/2318857"
},
{
"url": "https://bugzilla.redhat.com/2318858"
},
{
"url": "https://bugzilla.redhat.com/2318870"
},
{
"url": "https://bugzilla.redhat.com/2318873"
},
{
"url": "https://bugzilla.redhat.com/2318874"
},
{
"url": "https://bugzilla.redhat.com/2318876"
},
{
"url": "https://bugzilla.redhat.com/2318882"
},
{
"url": "https://bugzilla.redhat.com/2318883"
},
{
"url": "https://bugzilla.redhat.com/2318884"
},
{
"url": "https://bugzilla.redhat.com/2318885"
},
{
"url": "https://bugzilla.redhat.com/2318886"
},
{
"url": "https://bugzilla.redhat.com/2318897"
},
{
"url": "https://bugzilla.redhat.com/2318900"
},
{
"url": "https://bugzilla.redhat.com/2318905"
},
{
"url": "https://bugzilla.redhat.com/2318914"
},
{
"url": "https://bugzilla.redhat.com/2318922"
},
{
"url": "https://bugzilla.redhat.com/2318923"
},
{
"url": "https://bugzilla.redhat.com/2318925"
},
{
"url": "https://bugzilla.redhat.com/2318926"
},
{
"url": "https://bugzilla.redhat.com/2318927"
},
{
"url": "https://bugzilla.redhat.com/2331191"
},
{
"url": "https://bugzilla.redhat.com/2339218"
},
{
"url": "https://bugzilla.redhat.com/2339220"
},
{
"url": "https://bugzilla.redhat.com/2339221"
},
{
"url": "https://bugzilla.redhat.com/2339226"
},
{
"url": "https://bugzilla.redhat.com/2339231"
},
{
"url": "https://bugzilla.redhat.com/2339236"
},
{
"url": "https://bugzilla.redhat.com/2339238"
},
{
"url": "https://bugzilla.redhat.com/2339243"
},
{
"url": "https://bugzilla.redhat.com/2339247"
},
{
"url": "https://bugzilla.redhat.com/2339252"
},
{
"url": "https://bugzilla.redhat.com/2339259"
},
{
"url": "https://bugzilla.redhat.com/2339266"
},
{
"url": "https://bugzilla.redhat.com/2339270"
},
{
"url": "https://bugzilla.redhat.com/2339271"
},
{
"url": "https://bugzilla.redhat.com/2339275"
},
{
"url": "https://bugzilla.redhat.com/2339277"
},
{
"url": "https://bugzilla.redhat.com/2339281"
},
{
"url": "https://bugzilla.redhat.com/2339284"
},
{
"url": "https://bugzilla.redhat.com/2339291"
},
{
"url": "https://bugzilla.redhat.com/2339293"
},
{
"url": "https://bugzilla.redhat.com/2339295"
},
{
"url": "https://bugzilla.redhat.com/2339299"
},
{
"url": "https://bugzilla.redhat.com/2339300"
},
{
"url": "https://bugzilla.redhat.com/2339304"
},
{
"url": "https://bugzilla.redhat.com/2339305"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305"
},
{
"url": "https://curl.se/docs/CVE-2024-11053.html"
},
{
"url": "https://curl.se/docs/CVE-2024-11053.json"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-1671.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:1673"
},
{
"url": "https://hackerone.com/reports/2829063"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-11053.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-1673.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11053"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250124-0012/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0003/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250131-0004/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7162-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-11053"
},
{
"url": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL"
}
],
"published": "2024-12-11T08:15:05+00:00",
"updated": "2025-11-03T21:16:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2024-13176",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
385
],
"description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-13176"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/01/20/2"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:16046"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-13176"
},
{
"url": "https://bugzilla.redhat.com/2359885"
},
{
"url": "https://bugzilla.redhat.com/2359888"
},
{
"url": "https://bugzilla.redhat.com/2359892"
},
{
"url": "https://bugzilla.redhat.com/2359894"
},
{
"url": "https://bugzilla.redhat.com/2359895"
},
{
"url": "https://bugzilla.redhat.com/2359899"
},
{
"url": "https://bugzilla.redhat.com/2359900"
},
{
"url": "https://bugzilla.redhat.com/2359902"
},
{
"url": "https://bugzilla.redhat.com/2359903"
},
{
"url": "https://bugzilla.redhat.com/2359911"
},
{
"url": "https://bugzilla.redhat.com/2359918"
},
{
"url": "https://bugzilla.redhat.com/2359920"
},
{
"url": "https://bugzilla.redhat.com/2359924"
},
{
"url": "https://bugzilla.redhat.com/2359928"
},
{
"url": "https://bugzilla.redhat.com/2359930"
},
{
"url": "https://bugzilla.redhat.com/2359932"
},
{
"url": "https://bugzilla.redhat.com/2359934"
},
{
"url": "https://bugzilla.redhat.com/2359938"
},
{
"url": "https://bugzilla.redhat.com/2359940"
},
{
"url": "https://bugzilla.redhat.com/2359943"
},
{
"url": "https://bugzilla.redhat.com/2359944"
},
{
"url": "https://bugzilla.redhat.com/2359945"
},
{
"url": "https://bugzilla.redhat.com/2359947"
},
{
"url": "https://bugzilla.redhat.com/2359950"
},
{
"url": "https://bugzilla.redhat.com/2359963"
},
{
"url": "https://bugzilla.redhat.com/2359964"
},
{
"url": "https://bugzilla.redhat.com/2359972"
},
{
"url": "https://bugzilla.redhat.com/2370920"
},
{
"url": "https://bugzilla.redhat.com/2380264"
},
{
"url": "https://bugzilla.redhat.com/2380273"
},
{
"url": "https://bugzilla.redhat.com/2380274"
},
{
"url": "https://bugzilla.redhat.com/2380278"
},
{
"url": "https://bugzilla.redhat.com/2380280"
},
{
"url": "https://bugzilla.redhat.com/2380283"
},
{
"url": "https://bugzilla.redhat.com/2380284"
},
{
"url": "https://bugzilla.redhat.com/2380290"
},
{
"url": "https://bugzilla.redhat.com/2380291"
},
{
"url": "https://bugzilla.redhat.com/2380295"
},
{
"url": "https://bugzilla.redhat.com/2380298"
},
{
"url": "https://bugzilla.redhat.com/2380306"
},
{
"url": "https://bugzilla.redhat.com/2380308"
},
{
"url": "https://bugzilla.redhat.com/2380309"
},
{
"url": "https://bugzilla.redhat.com/2380310"
},
{
"url": "https://bugzilla.redhat.com/2380312"
},
{
"url": "https://bugzilla.redhat.com/2380313"
},
{
"url": "https://bugzilla.redhat.com/2380320"
},
{
"url": "https://bugzilla.redhat.com/2380321"
},
{
"url": "https://bugzilla.redhat.com/2380322"
},
{
"url": "https://bugzilla.redhat.com/2380326"
},
{
"url": "https://bugzilla.redhat.com/2380327"
},
{
"url": "https://bugzilla.redhat.com/2380334"
},
{
"url": "https://bugzilla.redhat.com/2380335"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338999"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359892"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359894"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359895"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359899"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359900"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359902"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359903"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359911"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359918"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359920"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359924"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359928"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359930"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359932"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359934"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359938"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359940"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359943"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359944"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359945"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359947"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359950"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359963"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359964"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359972"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370920"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380264"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380273"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380274"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380278"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380280"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380283"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380284"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380290"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380291"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380295"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380298"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380306"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380308"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380309"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380310"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380312"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380313"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380320"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380321"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380322"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380326"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380327"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380334"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380335"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-16046.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:15699"
},
{
"url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844"
},
{
"url": "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467"
},
{
"url": "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902"
},
{
"url": "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65"
},
{
"url": "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-13176.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-16046.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13176"
},
{
"url": "https://openssl-library.org/news/secadv/20250120.txt"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250124-0005/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250418-0010/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250502-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7264-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7278-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-13176"
},
{
"url": "https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL"
}
],
"published": "2025-01-20T14:15:26+00:00",
"updated": "2025-11-03T20:16:08+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
]
},
{
"id": "CVE-2024-2236",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
385
],
"description": "A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-2236"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9404"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3530"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3534"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-2236"
},
{
"url": "https://bugzilla.redhat.com/2245218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2245218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268268"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2236"
},
{
"url": "https://dev.gnupg.org/T7136"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9404.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9404"
},
{
"url": "https://github.com/tomato42/marvin-toolkit/tree/master/example/libgcrypt"
},
{
"url": "https://gitlab.com/redhat-crypto/libgcrypt/libgcrypt-mirror/-/merge_requests/17"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-2236.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9404.html"
},
{
"url": "https://lists.gnupg.org/pipermail/gcrypt-devel/2024-March/005607.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2236"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2236"
}
],
"published": "2024-03-06T22:15:57+00:00",
"updated": "2026-02-25T20:17:20+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.8.5-7.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libgcrypt@1.8.5-7.el8_6?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-2511",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
1325
],
"description": "Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-2511"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/04/08/5"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9333"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-2511"
},
{
"url": "https://bugzilla.redhat.com/2274020"
},
{
"url": "https://bugzilla.redhat.com/2281029"
},
{
"url": "https://bugzilla.redhat.com/2283757"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281029"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283757"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4603"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4741"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9333.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9333"
},
{
"url": "https://github.com/openssl/openssl/commit/7e4d731b1c07201ad9374c1cd9ac5263bdf35bce"
},
{
"url": "https://github.com/openssl/openssl/commit/b52867a9f618bb955bed2a3ce3db4d4f97ed8e5d"
},
{
"url": "https://github.com/openssl/openssl/commit/e9d7083e241670332e0443da0f0d4ffb52829f08"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/5f8d25770ae6437db119dfc951e207271a326640"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-2511.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9333.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2511"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240503-0013/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6937-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-2511"
},
{
"url": "https://www.openssl.org/news/secadv/20240408.txt"
},
{
"url": "https://www.openssl.org/news/vulnerabilities.html"
}
],
"published": "2024-04-08T14:15:07+00:00",
"updated": "2025-11-03T22:16:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-25260",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-25260"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-25260"
},
{
"url": "https://github.com/schsiung/fuzzer_issues/issues/1"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25260"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31058"
},
{
"url": "https://sourceware.org/elfutils/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7369-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-25260"
}
],
"published": "2024-02-20T18:15:52+00:00",
"updated": "2025-04-25T20:42:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.190-2.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.190-2.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.190-2.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.190-2.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/elfutils-libelf@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/elfutils-libs@0.190-2.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-33655",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400
],
"description": "The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-33655"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-33655"
},
{
"url": "https://alas.aws.amazon.com/ALAS-2024-1934.html"
},
{
"url": "https://datatracker.ietf.org/doc/html/rfc1035"
},
{
"url": "https://github.com/NLnetLabs/unbound/commit/c3206f4568f60c486be6d165b1f2b5b254fea3de"
},
{
"url": "https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md#version-120"
},
{
"url": "https://gitlab.isc.org/isc-projects/bind9/-/issues/4398"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00019.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TBXPRJ2Q235YUZKYDRWOSYNDFBJQWJ3/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QITY2QBX2OCBTZIXD2A5ES62STFIA4AL/"
},
{
"url": "https://meterpreter.org/researchers-uncover-dnsbomb-a-new-pdos-attack-exploiting-legitimate-dns-features/"
},
{
"url": "https://nlnetlabs.nl/downloads/unbound/CVE-2024-33655.txt"
},
{
"url": "https://nlnetlabs.nl/projects/unbound/security-advisories/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33655"
},
{
"url": "https://sp2024.ieee-security.org/accepted-papers.html"
},
{
"url": "https://ubuntu.com/security/notices/USN-6791-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33655"
},
{
"url": "https://www.isc.org/blogs/2024-dnsbomb/"
},
{
"url": "https://www.nlnetlabs.nl/news/2024/May/08/unbound-1.20.0-released/"
}
],
"published": "2024-06-06T17:15:51+00:00",
"updated": "2025-11-04T22:16:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-34459",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
122
],
"description": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-34459"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459"
},
{
"url": "https://ubuntu.com/security/notices/USN-7240-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7302-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34459"
}
],
"published": "2024-05-14T15:39:11+00:00",
"updated": "2025-11-04T22:16:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable."
}
},
{
"id": "CVE-2024-41996",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
295
],
"description": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-41996"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-41996"
},
{
"url": "https://dheatattack.gitlab.io/details/"
},
{
"url": "https://dheatattack.gitlab.io/faq/"
},
{
"url": "https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1"
},
{
"url": "https://github.com/openssl/openssl/issues/17374"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41996"
},
{
"url": "https://openssl-library.org/post/2022-10-21-tls-groups-configuration/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41996"
}
],
"published": "2024-08-26T06:15:04+00:00",
"updated": "2024-08-26T16:35:11+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-43167",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-43167"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/08/16/6"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-43167"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303456"
},
{
"url": "https://github.com/NLnetLabs/unbound/issues/1072"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1073"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1073/files"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43167"
},
{
"url": "https://ubuntu.com/security/notices/USN-6998-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43167"
}
],
"published": "2024-08-12T13:38:35+00:00",
"updated": "2025-11-03T22:18:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-43168",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
122
],
"description": "DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-43168"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-43168"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2303462"
},
{
"url": "https://github.com/NLnetLabs/unbound/issues/1039"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1040"
},
{
"url": "https://github.com/NLnetLabs/unbound/pull/1040/files"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00046.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43168"
},
{
"url": "https://ubuntu.com/security/notices/USN-6998-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43168"
}
],
"published": "2024-08-12T13:38:36+00:00",
"updated": "2025-11-03T22:18:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-4741",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
416
],
"description": "Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-4741"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:9333"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-4741"
},
{
"url": "https://bugzilla.redhat.com/2274020"
},
{
"url": "https://bugzilla.redhat.com/2281029"
},
{
"url": "https://bugzilla.redhat.com/2283757"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2274020"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281029"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2283757"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-2511"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4603"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4741"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2024-9333.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2024:9333"
},
{
"url": "https://github.com/openssl/openssl/commit/704f725b96aa373ee45ecfb23f6abfe8be8d9177"
},
{
"url": "https://github.com/openssl/openssl/commit/b3f0eb0a295f58f16ba43ba99dad70d4ee5c437d"
},
{
"url": "https://github.com/openssl/openssl/commit/c88c3de51020c37e8706bf7a682a162593053aac"
},
{
"url": "https://github.com/openssl/openssl/commit/e5093133c35ca82874ad83697af76f4b0f7e3bd8"
},
{
"url": "https://github.openssl.org/openssl/extended-releases/commit/f7a045f3143fc6da2ee66bf52d8df04829590dd4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-4741.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2024-9333.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4741"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240621-0004/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6937-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7894-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-4741"
},
{
"url": "https://www.openssl.org/news/secadv/20240528.txt"
}
],
"published": "2024-11-13T11:15:04+00:00",
"updated": "2025-11-04T18:16:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable."
}
},
{
"id": "CVE-2024-56433",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
1188
],
"description": "shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-56433"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:20559"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-56433"
},
{
"url": "https://bugzilla.redhat.com/2334165"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334165"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56433"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-20559.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:20145"
},
{
"url": "https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241"
},
{
"url": "https://github.com/shadow-maint/shadow/issues/1157"
},
{
"url": "https://github.com/shadow-maint/shadow/releases/tag/4.4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-56433.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-20559-0.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56433"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56433"
}
],
"published": "2024-12-26T09:15:07+00:00",
"updated": "2024-12-26T09:15:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:4.6-23.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/shadow-utils@4.6-23.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-57970",
"ratings": [
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
}
],
"cwes": [
126
],
"description": "libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in archive_read_support_format_tar.c via a TAR archive because it mishandles truncation in the middle of a GNU long linkname.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-57970"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-57970"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2345954"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57970"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:7510"
},
{
"url": "https://github.com/libarchive/libarchive/issues/2415"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2422"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-57970.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-7510.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57970"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-57970"
}
],
"published": "2025-02-16T04:15:21+00:00",
"updated": "2025-02-18T17:15:19+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-7264",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-7264"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/07/31/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:1671"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-7264"
},
{
"url": "https://bugzilla.redhat.com/2294581"
},
{
"url": "https://bugzilla.redhat.com/2294676"
},
{
"url": "https://bugzilla.redhat.com/2301888"
},
{
"url": "https://bugzilla.redhat.com/2318857"
},
{
"url": "https://bugzilla.redhat.com/2318858"
},
{
"url": "https://bugzilla.redhat.com/2318870"
},
{
"url": "https://bugzilla.redhat.com/2318873"
},
{
"url": "https://bugzilla.redhat.com/2318874"
},
{
"url": "https://bugzilla.redhat.com/2318876"
},
{
"url": "https://bugzilla.redhat.com/2318882"
},
{
"url": "https://bugzilla.redhat.com/2318883"
},
{
"url": "https://bugzilla.redhat.com/2318884"
},
{
"url": "https://bugzilla.redhat.com/2318885"
},
{
"url": "https://bugzilla.redhat.com/2318886"
},
{
"url": "https://bugzilla.redhat.com/2318897"
},
{
"url": "https://bugzilla.redhat.com/2318900"
},
{
"url": "https://bugzilla.redhat.com/2318905"
},
{
"url": "https://bugzilla.redhat.com/2318914"
},
{
"url": "https://bugzilla.redhat.com/2318922"
},
{
"url": "https://bugzilla.redhat.com/2318923"
},
{
"url": "https://bugzilla.redhat.com/2318925"
},
{
"url": "https://bugzilla.redhat.com/2318926"
},
{
"url": "https://bugzilla.redhat.com/2318927"
},
{
"url": "https://bugzilla.redhat.com/2331191"
},
{
"url": "https://bugzilla.redhat.com/2339218"
},
{
"url": "https://bugzilla.redhat.com/2339220"
},
{
"url": "https://bugzilla.redhat.com/2339221"
},
{
"url": "https://bugzilla.redhat.com/2339226"
},
{
"url": "https://bugzilla.redhat.com/2339231"
},
{
"url": "https://bugzilla.redhat.com/2339236"
},
{
"url": "https://bugzilla.redhat.com/2339238"
},
{
"url": "https://bugzilla.redhat.com/2339243"
},
{
"url": "https://bugzilla.redhat.com/2339247"
},
{
"url": "https://bugzilla.redhat.com/2339252"
},
{
"url": "https://bugzilla.redhat.com/2339259"
},
{
"url": "https://bugzilla.redhat.com/2339266"
},
{
"url": "https://bugzilla.redhat.com/2339270"
},
{
"url": "https://bugzilla.redhat.com/2339271"
},
{
"url": "https://bugzilla.redhat.com/2339275"
},
{
"url": "https://bugzilla.redhat.com/2339277"
},
{
"url": "https://bugzilla.redhat.com/2339281"
},
{
"url": "https://bugzilla.redhat.com/2339284"
},
{
"url": "https://bugzilla.redhat.com/2339291"
},
{
"url": "https://bugzilla.redhat.com/2339293"
},
{
"url": "https://bugzilla.redhat.com/2339295"
},
{
"url": "https://bugzilla.redhat.com/2339299"
},
{
"url": "https://bugzilla.redhat.com/2339300"
},
{
"url": "https://bugzilla.redhat.com/2339304"
},
{
"url": "https://bugzilla.redhat.com/2339305"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305"
},
{
"url": "https://curl.se/docs/CVE-2024-7264.html"
},
{
"url": "https://curl.se/docs/CVE-2024-7264.json"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-1671.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:1673"
},
{
"url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519"
},
{
"url": "https://hackerone.com/reports/2629968"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-7264.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-1673.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240828-0008/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241025-0006/"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241025-0010/"
},
{
"url": "https://ubuntu.com/security/notices/USN-6944-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-6944-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7264"
},
{
"url": "https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL"
}
],
"published": "2024-07-31T08:15:02+00:00",
"updated": "2025-11-03T23:17:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-7592",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "low"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "bitnami"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "low"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
400,
1333
],
"description": "There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-7592"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3634"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-7592"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2305879"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7592"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-3634.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:3634"
},
{
"url": "https://github.com/python/cpython/commit/391e5626e3ee5af267b97e37abc7475732e67621"
},
{
"url": "https://github.com/python/cpython/commit/44e458357fca05ca0ae2658d62c8c595b048b5ef"
},
{
"url": "https://github.com/python/cpython/commit/a77ab24427a18bff817025adb03ca920dc3f1a06"
},
{
"url": "https://github.com/python/cpython/commit/b2f11ca7667e4d57c71c1c88b255115f16042d9a"
},
{
"url": "https://github.com/python/cpython/commit/d4ac921a4b081f7f996a5d2b101684b67ba0ed7f"
},
{
"url": "https://github.com/python/cpython/commit/d662e2db2605515a767f88ad48096b8ac623c774"
},
{
"url": "https://github.com/python/cpython/commit/dcc3eaef98cd94d6cb6cb0f44bd1c903d04f33b1"
},
{
"url": "https://github.com/python/cpython/issues/123067"
},
{
"url": "https://github.com/python/cpython/pull/123075"
},
{
"url": "https://linux.oracle.com/cve/CVE-2024-7592.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-3634.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HXJAAAALNUNGCQUS2W7WR6GFIZIHFOOK/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592"
},
{
"url": "https://security.netapp.com/advisory/ntap-20241018-0006/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7015-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7015-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7592"
}
],
"published": "2024-08-19T19:15:08+00:00",
"updated": "2025-11-03T23:17:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
"versions": [
{
"version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Temurin JVM binary is not linked against freetype library:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\nlinux-vdso.so.1 (0x0000ffff8cd00000)\nlibjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\nlibpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\nlibdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\nlibc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n/lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-0938",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
20
],
"description": "The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.",
"recommendation": "Upgrade platform-python to version 3.6.8-74.el8_10; Upgrade python3-libs to version 3.6.8-74.el8_10",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-0938"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7109"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-0938"
},
{
"url": "https://bugzilla.redhat.com/2343237"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-7109.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23530"
},
{
"url": "https://github.com/python/cpython/commit/526617ed68cde460236c973e5d0a8bad4de896ba"
},
{
"url": "https://github.com/python/cpython/commit/90e526ae67b172ed7c6c56e7edad36263b0f9403"
},
{
"url": "https://github.com/python/cpython/commit/a7084f6075c9595ba60119ce8c62f1496f50c568"
},
{
"url": "https://github.com/python/cpython/commit/b8b4b713c5f8ec0958c7ef8d29d6711889bc94ab"
},
{
"url": "https://github.com/python/cpython/commit/d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a"
},
{
"url": "https://github.com/python/cpython/commit/ff4e5c25666f63544071a6b075ae8b25c98b7a32"
},
{
"url": "https://github.com/python/cpython/issues/105704"
},
{
"url": "https://github.com/python/cpython/pull/129418"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-0938.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-5588.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K4EUG6EKV6JYFIC24BASYOZS4M5XOQIB/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0938"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250314-0002/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7280-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7280-2"
},
{
"url": "https://ubuntu.com/security/notices/USN-7280-3"
},
{
"url": "https://ubuntu.com/security/notices/USN-7348-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7348-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0938"
}
],
"published": "2025-01-31T18:15:38+00:00",
"updated": "2025-11-03T21:18:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-11411",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
349
],
"description": "NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-11411"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/26/4"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11411"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00008.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00032.html"
},
{
"url": "https://nlnetlabs.nl/news/2025/Nov/26/unbound-1.24.2-released/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11411"
},
{
"url": "https://ubuntu.com/security/notices/USN-7855-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7855-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11411"
},
{
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2025-11411.txt"
}
],
"published": "2025-10-22T13:15:29+00:00",
"updated": "2025-12-05T11:15:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.16.2-5.9.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-unbound@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/unbound-libs@1.16.2-5.9.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-11468",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
93
],
"description": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-11468"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11468"
},
{
"url": "https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094"
},
{
"url": "https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2"
},
{
"url": "https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6"
},
{
"url": "https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66"
},
{
"url": "https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0"
},
{
"url": "https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796"
},
{
"url": "https://github.com/python/cpython/issues/143935"
},
{
"url": "https://github.com/python/cpython/pull/143936"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11468"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11468"
}
],
"published": "2026-01-20T22:15:50+00:00",
"updated": "2026-03-03T15:16:13+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-11961",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 1.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
122,
126
],
"description": "pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-11961"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-11961"
},
{
"url": "https://github.com/the-tcpdump-group/libpcap/commit/b2d2f9a9a0581c40780bde509f7cc715920f1c02"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11961"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11961"
}
],
"published": "2025-12-31T01:15:54+00:00",
"updated": "2025-12-31T20:42:15+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14",
"versions": [
{
"version": "14:1.9.1-5.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libpcap@1.9.1-5.el8?arch=x86_64&distro=redhat-8.10&epoch=14"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-12781",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
704
],
"description": "When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python.\u00a0Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-12781"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-12781"
},
{
"url": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b"
},
{
"url": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947"
},
{
"url": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5"
},
{
"url": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76"
},
{
"url": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5"
},
{
"url": "https://github.com/python/cpython/issues/125346"
},
{
"url": "https://github.com/python/cpython/pull/141128"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12781"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-12781"
}
],
"published": "2026-01-21T20:16:04+00:00",
"updated": "2026-02-02T17:25:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-13151",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-13151"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/08/5"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-13151"
},
{
"url": "https://gitlab.com/gnutls/libtasn1"
},
{
"url": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151"
},
{
"url": "https://ubuntu.com/security/notices/USN-7954-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7954-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
},
{
"url": "https://www.kb.cert.org/vuls/id/271649"
}
],
"published": "2026-01-07T22:15:43+00:00",
"updated": "2026-02-02T19:27:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "4.13-5.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libtasn1@4.13-5.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-13837",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-13837"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-13837"
},
{
"url": "https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036"
},
{
"url": "https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b"
},
{
"url": "https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70"
},
{
"url": "https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba"
},
{
"url": "https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb"
},
{
"url": "https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111"
},
{
"url": "https://github.com/python/cpython/issues/119342"
},
{
"url": "https://github.com/python/cpython/pull/119343"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13837"
}
],
"published": "2025-12-01T18:16:04+00:00",
"updated": "2026-03-03T15:16:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-14017",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"description": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-14017"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/3"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14017"
},
{
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"url": "https://curl.se/docs/CVE-2025-14017.json"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8062-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
}
],
"published": "2026-01-08T10:15:45+00:00",
"updated": "2026-01-27T21:29:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-14087",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 9.8,
"severity": "critical",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "critical"
},
{
"source": {
"name": "redhat"
},
"score": 5.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-14087"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14087"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419093"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4933"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4934"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14087"
}
],
"published": "2025-12-10T09:15:47+00:00",
"updated": "2026-03-18T17:16:03+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-14512",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-14512"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14512"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421339"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4935"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4936"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14512"
}
],
"published": "2025-12-11T07:16:00+00:00",
"updated": "2026-03-19T10:16:16+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-14831",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
407
],
"description": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
"recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.5",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-14831"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:3477"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4188"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4655"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4943"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5585"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5606"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"url": "https://bugzilla.redhat.com/2392528"
},
{
"url": "https://bugzilla.redhat.com/2423177"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14831"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9820"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-4188.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:3477"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-14831.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-5585.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
},
{
"url": "https://ubuntu.com/security/notices/USN-8043-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
}
],
"published": "2026-02-09T15:16:09+00:00",
"updated": "2026-03-24T11:16:21+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.16-8.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-15281",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
908
],
"description": "Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.",
"recommendation": "Upgrade glibc to version 2.28-251.el8_10.31; Upgrade glibc-common to version 2.28-251.el8_10.31; Upgrade glibc-minimal-langpack to version 2.28-251.el8_10.31",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15281"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/20/3"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:2786"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15281"
},
{
"url": "https://bugzilla.redhat.com/2429771"
},
{
"url": "https://bugzilla.redhat.com/2430201"
},
{
"url": "https://bugzilla.redhat.com/2431196"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430201"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431196"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15281"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0915"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-2786.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:4772"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-15281.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50174.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15281"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33814"
},
{
"url": "https://ubuntu.com/security/notices/USN-8005-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15281"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/01/20/3"
}
],
"published": "2026-01-20T14:16:07+00:00",
"updated": "2026-02-05T17:43:18+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-15282",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
93
],
"description": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15282"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15282"
},
{
"url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0"
},
{
"url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38"
},
{
"url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80"
},
{
"url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47"
},
{
"url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a"
},
{
"url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f"
},
{
"url": "https://github.com/python/cpython/issues/143925"
},
{
"url": "https://github.com/python/cpython/pull/143926"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-3"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15282"
}
],
"published": "2026-01-20T22:15:50+00:00",
"updated": "2026-01-26T15:16:06+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-15468",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: If an application using the SSL_CIPHER_find() function in\na QUIC protocol client or server receives an unknown cipher suite from\nthe peer, a NULL dereference occurs.\n\nImpact summary: A NULL pointer dereference leads to abnormal termination of\nthe running process causing Denial of Service.\n\nSome applications call SSL_CIPHER_find() from the client_hello_cb callback\non the cipher ID received from the peer. If this is done with an SSL object\nimplementing the QUIC protocol, NULL pointer dereference will happen if\nthe examined cipher ID is unknown or unsupported.\n\nAs it is not very common to call this function in applications using the QUIC \nprotocol and the worst outcome is Denial of Service, the issue was assessed\nas Low severity.\n\nThe vulnerable code was introduced in the 3.2 version with the addition\nof the QUIC protocol support.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the QUIC implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15468"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15468"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/1f08e54bad32843044fe8a675948d65e3b4ece65"
},
{
"url": "https://github.com/openssl/openssl/commit/7c88376731c589ee5b36116c5a6e32d5ae5f7ae2"
},
{
"url": "https://github.com/openssl/openssl/commit/b2539639400288a4580fe2d76247541b976bade4"
},
{
"url": "https://github.com/openssl/openssl/commit/d75b309879631d45b972396ce4e5102559c64ac7"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-15468.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15468"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15468"
}
],
"published": "2026-01-27T16:16:14+00:00",
"updated": "2026-02-02T18:38:00+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-15469",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
347
],
"description": "Issue summary: The 'openssl dgst' command-line tool silently truncates input\ndata to 16MB when using one-shot signing algorithms and reports success instead\nof an error.\n\nImpact summary: A user signing or verifying files larger than 16MB with\none-shot algorithms (such as Ed25519, Ed448, or ML-DSA) may believe the entire\nfile is authenticated while trailing data beyond 16MB remains unauthenticated.\n\nWhen the 'openssl dgst' command is used with algorithms that only support\none-shot signing (Ed25519, Ed448, ML-DSA-44, ML-DSA-65, ML-DSA-87), the input\nis buffered with a 16MB limit. If the input exceeds this limit, the tool\nsilently truncates to the first 16MB and continues without signaling an error,\ncontrary to what the documentation states. This creates an integrity gap where\ntrailing bytes can be modified without detection if both signing and\nverification are performed using the same affected codepath.\n\nThe issue affects only the command-line tool behavior. Verifiers that process\nthe full message using library APIs will reject the signature, so the risk\nprimarily affects workflows that both sign and verify with the affected\n'openssl dgst' command. Streaming digest algorithms for 'openssl dgst' and\nlibrary users are unaffected.\n\nThe FIPS modules in 3.5 and 3.6 are not affected by this issue, as the\ncommand-line tools are outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.5 and 3.6 are vulnerable to this issue.\n\nOpenSSL 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-15469"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-15469"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/310f305eb92ea8040d6b3cb75a5feeba8e6acf2f"
},
{
"url": "https://github.com/openssl/openssl/commit/a7936fa4bd23c906e1955a16a0a0ab39a4953a61"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-15469.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15469"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15469"
}
],
"published": "2026-01-27T16:16:14+00:00",
"updated": "2026-02-02T18:37:39+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-1632",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
404,
476
],
"description": "A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-1632"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-1632"
},
{
"url": "https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1632"
},
{
"url": "https://ubuntu.com/security/notices/USN-7454-1"
},
{
"url": "https://vuldb.com/?ctiid.296619"
},
{
"url": "https://vuldb.com/?id.296619"
},
{
"url": "https://vuldb.com/?submit.496460"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1632"
}
],
"published": "2025-02-24T14:15:11+00:00",
"updated": "2025-03-25T15:41:41+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-1795",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
116
],
"description": "During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-1795"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-1795"
},
{
"url": "https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48"
},
{
"url": "https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593"
},
{
"url": "https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74"
},
{
"url": "https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d"
},
{
"url": "https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090"
},
{
"url": "https://github.com/python/cpython/issues/100884"
},
{
"url": "https://github.com/python/cpython/pull/100885"
},
{
"url": "https://github.com/python/cpython/pull/119099"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1795"
},
{
"url": "https://ubuntu.com/security/notices/USN-7570-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1795"
}
],
"published": "2025-02-28T19:15:36+00:00",
"updated": "2025-11-03T21:18:53+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1",
"versions": [
{
"version": "20.2.4-9.module+el8.10.0+21329+8d76b841",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4",
"versions": [
{
"version": "50.3.2-7.module+el8.10.0+23406+03055bfb",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4",
"versions": [
{
"version": "3.9.25-2.module+el8.10.0+23718+1842ae33",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-libs@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip-wheel@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-pip@20.2.4-9.module%2Bel8.10.0%2B21329%2B8d76b841?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020240214182535%3A7044f6c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39-setuptools-wheel@50.3.2-7.module%2Bel8.10.0%2B23406%2B03055bfb?arch=noarch&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020250806092742%3Ad47b87a4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python39@3.9.25-2.module%2Bel8.10.0%2B23718%2B1842ae33?arch=x86_64&distro=redhat-8.10&modularitylabel=python39%3A3.9%3A8100020251126112422%3Ad47b87a4"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-25724",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
252
],
"description": "list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-25724"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9431"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-25724"
},
{
"url": "https://bugzilla.redhat.com/2349221"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349221"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25724"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-9431.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:9420"
},
{
"url": "https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92"
},
{
"url": "https://github.com/Ekkosun/pocs/blob/main/bsdtarbug"
},
{
"url": "https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-25724.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-9431.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25724"
},
{
"url": "https://ubuntu.com/security/notices/USN-7454-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25724"
}
],
"published": "2025-03-02T02:15:36+00:00",
"updated": "2025-07-17T15:56:36+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-27113",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-27113"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/10"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/11"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/12"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/13"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/4"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/5"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Apr/9"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-27113"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250306-0004/"
},
{
"url": "https://ubuntu.com/security/notices/USN-7302-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27113"
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/02/18/2"
}
],
"published": "2025-02-18T23:15:10+00:00",
"updated": "2025-11-03T22:18:43+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-30258",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 2.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
754
],
"description": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-30258"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-30258"
},
{
"url": "https://dev.gnupg.org/T7527"
},
{
"url": "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158"
},
{
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30258"
},
{
"url": "https://ubuntu.com/security/notices/USN-7412-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7412-3"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-30258"
}
],
"published": "2025-03-19T20:15:20+00:00",
"updated": "2025-10-16T16:53:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-3360",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-3360"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-3360"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3360"
}
],
"published": "2025-04-07T13:15:43+00:00",
"updated": "2025-04-14T12:15:16+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-4516",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
416
],
"description": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-4516"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/16/4"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/19/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23530"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4516"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2321440"
},
{
"url": "https://bugzilla.redhat.com/2325776"
},
{
"url": "https://bugzilla.redhat.com/2343237"
},
{
"url": "https://bugzilla.redhat.com/2366509"
},
{
"url": "https://bugzilla.redhat.com/2370010"
},
{
"url": "https://bugzilla.redhat.com/2370014"
},
{
"url": "https://bugzilla.redhat.com/2370016"
},
{
"url": "https://bugzilla.redhat.com/2372426"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/8/ALSA-2025-23530.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23530"
},
{
"url": "https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292"
},
{
"url": "https://github.com/python/cpython/commit/5646648678295a44aa82636c6e92826651baf33a"
},
{
"url": "https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d"
},
{
"url": "https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142"
},
{
"url": "https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f"
},
{
"url": "https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77"
},
{
"url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
},
{
"url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e"
},
{
"url": "https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b"
},
{
"url": "https://github.com/python/cpython/issues/133767"
},
{
"url": "https://github.com/python/cpython/pull/129648"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-4516.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4516"
},
{
"url": "https://ubuntu.com/security/notices/USN-7570-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4516"
}
],
"published": "2025-05-15T14:15:31+00:00",
"updated": "2025-06-03T14:15:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-45582",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
24
],
"description": "GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-45582"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/01/6"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0067"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-45582"
},
{
"url": "https://bugzilla.redhat.com/2379592"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2379592"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-45582"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-0067.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:0002"
},
{
"url": "https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-45582.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-0067.html"
},
{
"url": "https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-45582"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-45582"
},
{
"url": "https://www.gnu.org/software/tar/"
},
{
"url": "https://www.gnu.org/software/tar/manual/html_node/Integrity.html"
},
{
"url": "https://www.gnu.org/software/tar/manual/html_node/Integrity.html#Integrity"
},
{
"url": "https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html"
}
],
"published": "2025-07-11T17:15:37+00:00",
"updated": "2025-11-02T01:15:32+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-4598",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
364
],
"description": "A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-4598"
},
{
"url": "http://seclists.org/fulldisclosure/2025/Jun/9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/06/05/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/06/05/3"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/08/18/3"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22660"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22868"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23227"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23234"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:0414"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1652"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4598"
},
{
"url": "https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598"
},
{
"url": "https://bugzilla.redhat.com/2369242"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369242"
},
{
"url": "https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-22660.html"
},
{
"url": "https://git.kernel.org/linus/b5325b2a270fcaf7b2a9a0f23d422ca8a5a8bdea"
},
{
"url": "https://github.com/systemd/systemd/commit/0c49e0049b7665bb7769a13ef346fef92e1ad4d6"
},
{
"url": "https://github.com/systemd/systemd/commit/13902e025321242b1d95c6d8b4e482b37f58cdef"
},
{
"url": "https://github.com/systemd/systemd/commit/49f1f2d4a7612bbed5211a73d11d6a94fbe3bb69"
},
{
"url": "https://github.com/systemd/systemd/commit/76e0ab49c47965877c19772a2b3bf55f6417ca39"
},
{
"url": "https://github.com/systemd/systemd/commit/868d95577ec9f862580ad365726515459be582fc"
},
{
"url": "https://github.com/systemd/systemd/commit/8fc7b2a211eb13ef1a94250b28e1c79cab8bdcb9"
},
{
"url": "https://github.com/systemd/systemd/commit/9ce8e3e449def92c75ada41b7d10c5bc3946be77"
},
{
"url": "https://github.com/systemd/systemd/commit/e6a8687b939ab21854f12f59a3cce703e32768cf"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-4598.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-22660.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4598"
},
{
"url": "https://ubuntu.com/security/notices/USN-7559-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4598"
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/05/29/3"
},
{
"url": "https://www.openwall.com/lists/oss-security/2025/08/18/3"
},
{
"url": "https://www.qualys.com/2025/05/29/apport-coredump/apport-coredump.txt"
}
],
"published": "2025-05-30T14:15:23+00:00",
"updated": "2026-02-02T10:16:05+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-47268",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-47268"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:9432"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-47268"
},
{
"url": "https://bugzilla.redhat.com/2364090"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364090"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1242300"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47268"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-9432.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:9421"
},
{
"url": "https://github.com/Zephkek/ping-rtt-overflow/"
},
{
"url": "https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40"
},
{
"url": "https://github.com/iputils/iputils/issues/584"
},
{
"url": "https://github.com/iputils/iputils/pull/585"
},
{
"url": "https://github.com/iputils/iputils/releases/tag/20250602"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-47268.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-9432.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-47268"
},
{
"url": "https://ubuntu.com/security/notices/USN-7670-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47268"
}
],
"published": "2025-05-05T14:15:29+00:00",
"updated": "2026-01-26T17:16:09+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "20180629-11.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-4878",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
416
],
"description": "A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-4878"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-4878"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2376184"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4878"
},
{
"url": "https://ubuntu.com/security/notices/USN-7619-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7696-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4878"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-4878.txt"
}
],
"published": "2025-07-22T15:15:36+00:00",
"updated": "2025-07-29T20:15:27+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-48964",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
190
],
"description": "ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply packet, because a zero timestamp can lead to large intermediate values that have an integer overflow when squared during statistics calculations. NOTE: this issue exists because of an incomplete fix for CVE-2025-47268 (that fix was only about timestamp calculations, and it did not account for a specific scenario where the original timestamp in the ICMP payload is zero).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-48964"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:17558"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-48964"
},
{
"url": "https://bugzilla.redhat.com/2382657"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2382657"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1243772"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48964"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-17558.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:17558"
},
{
"url": "https://github.com/iputils/iputils/commit/afa36390394a6e0cceba03b52b59b6d41710608c"
},
{
"url": "https://github.com/iputils/iputils/issues"
},
{
"url": "https://github.com/iputils/iputils/releases/tag/20250602"
},
{
"url": "https://github.com/iputils/iputils/security/advisories/GHSA-25fr-jw29-74f9"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-48964.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-17558.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48964"
},
{
"url": "https://ubuntu.com/security/notices/USN-7670-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48964"
}
],
"published": "2025-07-22T18:15:36+00:00",
"updated": "2025-08-26T19:15:41+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "20180629-11.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/iputils@20180629-11.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-50181",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
601
],
"description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-50181"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-50181"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181"
},
{
"url": "https://ubuntu.com/security/notices/USN-7599-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7599-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50181"
}
],
"published": "2025-06-19T01:15:24+00:00",
"updated": "2025-12-22T19:15:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-50182",
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
601
],
"description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-50182"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-50182"
},
{
"url": "https://github.com/urllib3/urllib3"
},
{
"url": "https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"
},
{
"url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0"
},
{
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50182"
},
{
"url": "https://ubuntu.com/security/notices/USN-7599-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-50182"
}
],
"published": "2025-06-19T02:15:17+00:00",
"updated": "2025-12-22T19:15:49+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-5278",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L"
}
],
"cwes": [
121
],
"description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5278"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/27/2"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/29/1"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/05/29/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5278"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368764"
},
{
"url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633"
},
{
"url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2025-5278"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5278"
}
],
"published": "2025-05-27T21:15:23+00:00",
"updated": "2025-10-22T20:15:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "8.30-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/coreutils-single@8.30-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5351",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
415
],
"description": "A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5351"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5351"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369367"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5351"
},
{
"url": "https://ubuntu.com/security/notices/USN-7619-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5351"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-5351.txt"
}
],
"published": "2025-07-04T09:15:37+00:00",
"updated": "2026-01-08T04:15:54+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5915",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 6.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.6,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
122
],
"description": "A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5915"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5915"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2599"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5915"
},
{
"url": "https://ubuntu.com/security/notices/USN-7601-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5915"
}
],
"published": "2025-06-09T20:15:26+00:00",
"updated": "2026-01-08T04:15:55+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5916",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5916"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5916"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370872"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2568"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2568/commits/bce70c4c26864df2a8d6953e7db6e4b156253508"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5916"
},
{
"url": "https://ubuntu.com/security/notices/USN-7601-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5916"
}
],
"published": "2025-06-09T20:15:27+00:00",
"updated": "2025-12-12T01:15:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5917",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 2.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5917"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5917"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370874"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2588"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5917"
},
{
"url": "https://ubuntu.com/security/notices/USN-7601-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5917"
}
],
"published": "2025-06-09T20:15:27+00:00",
"updated": "2025-12-12T01:15:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-5918",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 6.6,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 3.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L"
}
],
"cwes": [
125
],
"description": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-5918"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-5918"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2584"
},
{
"url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5918"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5918"
}
],
"published": "2025-06-09T20:15:27+00:00",
"updated": "2025-08-15T18:35:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-6069",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "bitnami"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1333
],
"description": "The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-6069"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23342"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6069"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23530"
},
{
"url": "https://github.com/python/cpython/commit/4455cbabf991e202185a25a631af206f60bbc949"
},
{
"url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
},
{
"url": "https://github.com/python/cpython/commit/6eb6c5dbfb528bd07d77b60fd71fd05d81d45c41"
},
{
"url": "https://github.com/python/cpython/commit/8d1b3dfa09135affbbf27fb8babcf3c11415df49"
},
{
"url": "https://github.com/python/cpython/commit/ab0893fd5c579d9cea30841680e6d35fc478afb5"
},
{
"url": "https://github.com/python/cpython/commit/d851f8e258c7328814943e923a7df81bca15df4b"
},
{
"url": "https://github.com/python/cpython/commit/f3c6f882cddc8dc30320d2e73edf019e201394fc"
},
{
"url": "https://github.com/python/cpython/commit/fdc9d214c01cb4588f540cfa03726bbf2a33fc15"
},
{
"url": "https://github.com/python/cpython/issues/135462"
},
{
"url": "https://github.com/python/cpython/pull/135464"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-6069.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/K5PIYLR6EP3WR7ZOKKYQUWEDNQVUXOYM/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6069"
},
{
"url": "https://ubuntu.com/security/notices/USN-7710-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6069"
}
],
"published": "2025-06-17T14:15:33+00:00",
"updated": "2025-07-07T18:15:29+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-6075",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "If the value passed to os.path.expandvars() is user-controlled a \nperformance degradation is possible when expanding environment \nvariables.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-6075"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23342"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6075"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:23530"
},
{
"url": "https://github.com/python/cpython/commit/2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c"
},
{
"url": "https://github.com/python/cpython/commit/5dceb93486176e6b4a6d9754491005113eb23427"
},
{
"url": "https://github.com/python/cpython/commit/631ba3407e3348ccd56ce5160c4fb2c5dc5f4d84"
},
{
"url": "https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca"
},
{
"url": "https://github.com/python/cpython/commit/9ab89c026aa9611c4b0b67c288b8303a480fe742"
},
{
"url": "https://github.com/python/cpython/commit/c8a5f3435c342964e0a432cc9fb448b7dbecd1ba"
},
{
"url": "https://github.com/python/cpython/commit/f029e8db626ddc6e3a3beea4eff511a71aaceb5c"
},
{
"url": "https://github.com/python/cpython/issues/136065"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-6075.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-23530.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6075"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6075"
}
],
"published": "2025-10-31T17:15:48+00:00",
"updated": "2026-02-04T19:05:15+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-60753",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"cwes": [
400,
835
],
"description": "An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-60753"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-60753"
},
{
"url": "https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753"
},
{
"url": "https://github.com/libarchive/libarchive/issues/2725"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60753"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-60753"
}
],
"published": "2025-11-05T16:15:40+00:00",
"updated": "2026-02-04T21:19:45+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-6170",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 2.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
121
],
"description": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-6170"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
},
{
"url": "https://ubuntu.com/security/notices/USN-7694-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
}
],
"published": "2025-06-16T16:15:20+00:00",
"updated": "2026-03-24T05:16:23+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-64118",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"cwes": [
362,
367
],
"description": "node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-64118"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-64118"
},
{
"url": "https://github.com/isaacs/node-tar"
},
{
"url": "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d"
},
{
"url": "https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9"
},
{
"url": "https://github.com/isaacs/node-tar/issues/445"
},
{
"url": "https://github.com/isaacs/node-tar/pull/446"
},
{
"url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64118"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-64118"
}
],
"published": "2025-10-30T18:15:33+00:00",
"updated": "2025-11-04T15:41:56+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-66199",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
789
],
"description": "Issue summary: A TLS 1.3 connection using certificate compression can be\nforced to allocate a large buffer before decompression without checking\nagainst the configured certificate size limit.\n\nImpact summary: An attacker can cause per-connection memory allocations of\nup to approximately 22 MiB and extra CPU work, potentially leading to\nservice degradation or resource exhaustion (Denial of Service).\n\nIn affected configurations, the peer-supplied uncompressed certificate\nlength from a CompressedCertificate message is used to grow a heap buffer\nprior to decompression. This length is not bounded by the max_cert_list\nsetting, which otherwise constrains certificate message sizes. An attacker\ncan exploit this to cause large per-connection allocations followed by\nhandshake failure. No memory corruption or information disclosure occurs.\n\nThis issue only affects builds where TLS 1.3 certificate compression is\ncompiled in (i.e., not OPENSSL_NO_COMP_ALG) and at least one compression\nalgorithm (brotli, zlib, or zstd) is available, and where the compression\nextension is negotiated. Both clients receiving a server CompressedCertificate\nand servers in mutual TLS scenarios receiving a client CompressedCertificate\nare affected. Servers that do not request client certificates are not\nvulnerable to client-initiated attacks.\n\nUsers can mitigate this issue by setting SSL_OP_NO_RX_CERTIFICATE_COMPRESSION\nto disable receiving compressed certificates.\n\nThe FIPS modules in 3.6, 3.5, 3.4 and 3.3 are not affected by this issue,\nas the TLS implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4 and 3.3 are vulnerable to this issue.\n\nOpenSSL 3.0, 1.1.1 and 1.0.2 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-66199"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-66199"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/3ed1f75249932b155eef993a8e66a99cb98bfef4"
},
{
"url": "https://github.com/openssl/openssl/commit/6184a4fb08ee6d7bca570d931a4e8bef40b64451"
},
{
"url": "https://github.com/openssl/openssl/commit/895150b5e021d16b52fb32b97e1dd12f20448be5"
},
{
"url": "https://github.com/openssl/openssl/commit/966a2478046c311ed7dae50c457d0db4cafbf7e4"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-66199.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66199"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66199"
}
],
"published": "2026-01-27T16:16:15+00:00",
"updated": "2026-02-02T18:37:19+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-66382",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
407
],
"description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-66382"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/12/02/1"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-66382"
},
{
"url": "https://github.com/libexpat/libexpat/issues/1076"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66382"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-66382"
}
],
"published": "2025-11-28T07:15:57+00:00",
"updated": "2025-12-19T16:05:03+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-1.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-68160",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
787
],
"description": "Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-68160"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-68160"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad"
},
{
"url": "https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6"
},
{
"url": "https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c"
},
{
"url": "https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0"
},
{
"url": "https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-68160.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68160"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68160"
}
],
"published": "2026-01-27T16:16:15+00:00",
"updated": "2026-02-02T18:36:57+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-68972",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
}
],
"cwes": [
347
],
"description": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-68972"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-68972"
},
{
"url": "https://gpg.fail/formfeed"
},
{
"url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i"
},
{
"url": "https://news.ycombinator.com/item?id=46404339"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68972"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68972"
}
],
"published": "2025-12-27T23:15:40+00:00",
"updated": "2026-01-09T20:08:47+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-69418",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
325
],
"description": "Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-69418"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-69418"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc"
},
{
"url": "https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8"
},
{
"url": "https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347"
},
{
"url": "https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae"
},
{
"url": "https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-69418.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69418"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69418"
}
],
"published": "2026-01-27T16:16:33+00:00",
"updated": "2026-02-02T18:36:03+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-69420",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
754
],
"description": "Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-69420"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-69420"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9"
},
{
"url": "https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a"
},
{
"url": "https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e"
},
{
"url": "https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b"
},
{
"url": "https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-69420.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69420"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69420"
}
],
"published": "2026-01-27T16:16:34+00:00",
"updated": "2026-02-02T18:33:30+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-69421",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-69421"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-69421"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b"
},
{
"url": "https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7"
},
{
"url": "https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd"
},
{
"url": "https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3"
},
{
"url": "https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-69421.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69421"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69421"
}
],
"published": "2026-01-27T16:16:34+00:00",
"updated": "2026-02-28T04:16:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-7039",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
22
],
"description": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-7039"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-7039"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392423"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7039"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7942-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7039"
}
],
"published": "2025-09-03T02:15:38+00:00",
"updated": "2025-09-04T15:36:56+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-70873",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"
}
],
"cwes": [
244
],
"description": "An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-70873"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-70873"
},
{
"url": "https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70873"
},
{
"url": "https://sqlite.org/forum/forumpost/761eac3c82"
},
{
"url": "https://sqlite.org/src/info/3d459f1fb1bd1b5e"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-70873"
}
],
"published": "2026-03-12T19:16:15+00:00",
"updated": "2026-03-16T14:18:02+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.26.0-20.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/sqlite-libs@3.26.0-20.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-8114",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
476
],
"description": "A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-8114"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8114"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383220"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d"
},
{
"url": "https://git.libssh.org/projects/libssh.git/commit/?id=65f363c9"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8114"
},
{
"url": "https://ubuntu.com/security/notices/USN-7849-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8114"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-8114.txt"
}
],
"published": "2025-07-24T15:15:27+00:00",
"updated": "2025-11-17T21:15:58+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-8277",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
401
],
"description": "A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory. This issue can lead to crashes on the client side, particularly when using libgcrypt, which impacts application stability and availability.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-8277"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8277"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2383888"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8277"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8277"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2025-8277.txt"
}
],
"published": "2025-09-09T12:15:30+00:00",
"updated": "2025-09-09T16:28:43+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-8291",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "bitnami"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1285
],
"description": "The 'zipfile' module would not check the validity of the ZIP64 End of\nCentral Directory (EOCD) Locator record offset value would not be used to\nlocate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be\nassumed to be the previous record in the ZIP archive. This could be abused\nto create ZIP archives that are handled differently by the 'zipfile' module\ncompared to other ZIP implementations.\n\n\nRemediation maintains this behavior, but checks that the offset specified\nin the ZIP64 EOCD Locator record matches the expected value.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-8291"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:23342"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-8291"
},
{
"url": "https://bugzilla.redhat.com/2294682"
},
{
"url": "https://bugzilla.redhat.com/2373234"
},
{
"url": "https://bugzilla.redhat.com/2402342"
},
{
"url": "https://bugzilla.redhat.com/2408891"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418655"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12084"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-23342.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:0123"
},
{
"url": "https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p"
},
{
"url": "https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json"
},
{
"url": "https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267"
},
{
"url": "https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46"
},
{
"url": "https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6"
},
{
"url": "https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196"
},
{
"url": "https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4"
},
{
"url": "https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388"
},
{
"url": "https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3"
},
{
"url": "https://github.com/python/cpython/issues/139700"
},
{
"url": "https://github.com/python/cpython/pull/139702"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-8291.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-0123.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8291"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7886-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8291"
}
],
"published": "2025-10-07T18:16:00+00:00",
"updated": "2025-10-29T16:15:35+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2025-9714",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "Uncontrolled recursion in\u00a0XPath evaluation\u00a0in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPathRunEval`, `xmlXPathCtxtCompile`, and `xmlXPathEvalExpr` were resetting recursion depth to zero before making potentially recursive calls. When such functions were called recursively this could allow for uncontrolled recursion and lead to a stack overflow. These functions now preserve recursion depth across recursive calls, allowing recursion depth to be controlled.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-9714"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22376"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-9714"
},
{
"url": "https://bugzilla.redhat.com/2392605"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392605"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9714"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2025-22376.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2025:22376"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/148"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-9714.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2025-22376.html"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2025/09/msg00035.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9714"
},
{
"url": "https://ubuntu.com/security/notices/USN-7743-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9714"
}
],
"published": "2025-09-10T19:15:42+00:00",
"updated": "2025-11-03T19:16:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2025-9820",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
121
],
"description": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.",
"recommendation": "Upgrade gnutls to version 3.6.16-8.el8_10.5",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-9820"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/11/20/2"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:3477"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4188"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4655"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:4943"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5585"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5606"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-9820"
},
{
"url": "https://bugzilla.redhat.com/2392528"
},
{
"url": "https://bugzilla.redhat.com/2423177"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14831"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9820"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-4188.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:3477"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5"
},
{
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1732"
},
{
"url": "https://linux.oracle.com/cve/CVE-2025-9820.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-5585.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820"
},
{
"url": "https://ubuntu.com/security/notices/USN-8043-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9820"
},
{
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18"
}
],
"published": "2026-01-26T20:16:09+00:00",
"updated": "2026-03-24T11:16:22+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.16-8.el8_10.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnutls@3.6.16-8.el8_10.4?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0672",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
93
],
"description": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0672"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0672"
},
{
"url": "https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172"
},
{
"url": "https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440"
},
{
"url": "https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d"
},
{
"url": "https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca"
},
{
"url": "https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70"
},
{
"url": "https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85"
},
{
"url": "https://github.com/python/cpython/issues/143919"
},
{
"url": "https://github.com/python/cpython/pull/143920"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8018-3"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0672"
}
],
"published": "2026-01-20T22:15:52+00:00",
"updated": "2026-01-26T15:16:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0915",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "medium"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
},
{
"source": {
"name": "rocky"
},
"severity": "medium"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
908
],
"description": "Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.",
"recommendation": "Upgrade glibc to version 2.28-251.el8_10.31; Upgrade glibc-common to version 2.28-251.el8_10.31; Upgrade glibc-minimal-langpack to version 2.28-251.el8_10.31",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0915"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/16/6"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:2786"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0915"
},
{
"url": "https://bugzilla.redhat.com/2429771"
},
{
"url": "https://bugzilla.redhat.com/2430201"
},
{
"url": "https://bugzilla.redhat.com/2431196"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430201"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431196"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15281"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0915"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-2786.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:4772"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-0915.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50174.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0915"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802"
},
{
"url": "https://ubuntu.com/security/notices/USN-8005-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0915"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/01/16/6"
}
],
"published": "2026-01-15T22:16:12+00:00",
"updated": "2026-01-23T19:36:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-0964",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
22
],
"description": "A malicious SCP server can send unexpected paths that could make the\nclient application override local files outside of working directory.\nThis could be misused to create malicious executable or configuration\nfiles and make the user execute them under specific consequences.\n\nThis is the same issue as in OpenSSH, tracked as CVE-2019-6111.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0964"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0964"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436979"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0964"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0964"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0964.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-03-30T13:26:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0965",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
73
],
"description": "A flaw was found in libssh where it can attempt to open arbitrary files during configuration parsing. A local attacker can exploit this by providing a malicious configuration file or when the system is misconfigured. This vulnerability could lead to a Denial of Service (DoS) by causing the system to try and access dangerous files, such as block devices or large system files, which can disrupt normal operations.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0965"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0965"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436980"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0965"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0965"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0965.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-04-02T17:33:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0966",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
124
],
"description": "The API function `ssh_get_hexa()` is vulnerable, when 0-lenght\ninput is provided to this function. This function is used internally\nin `ssh_get_fingerprint_hash()` and `ssh_print_hexa()` (deprecated),\nwhich is vulnerable to the same input (length is provided by the\ncalling application).\n\nThe function is also used internally in the gssapi code for logging\nthe OIDs received by the server during GSSAPI authentication. This\ncould be triggered remotely, when the server allows GSSAPI authentication\nand logging verbosity is set at least to SSH_LOG_PACKET (3). This\ncould cause self-DoS of the per-connection daemon process.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0966"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0966"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433121"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0966"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0966"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0966.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-03-30T13:26:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0967",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 2.2,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1333
],
"description": "A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0967"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0967"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436981"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0967"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0967"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0967.txt"
}
],
"published": "2026-03-26T21:17:00+00:00",
"updated": "2026-04-02T17:28:27+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0968",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv3",
"vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "A flaw was found in libssh in which a malicious SFTP (SSH File Transfer Protocol) server can exploit this by sending a malformed 'longname' field within an `SSH_FXP_NAME` message during a file listing operation. This missing null check can lead to reading beyond allocated memory on the heap. This can cause unexpected behavior or lead to a denial of service (DoS) due to application crashes.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0968"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0968"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436982"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0968"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8051-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0968"
},
{
"url": "https://www.libssh.org/2026/02/10/libssh-0-12-0-and-0-11-4-security-releases/"
},
{
"url": "https://www.libssh.org/security/advisories/CVE-2026-0968.txt"
}
],
"published": "2026-03-26T21:17:01+00:00",
"updated": "2026-03-30T13:26:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0988",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0988"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0988"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0988"
},
{
"url": "https://ubuntu.com/security/notices/USN-7971-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0988"
}
],
"published": "2026-01-21T12:15:55+00:00",
"updated": "2026-03-19T10:16:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0989",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0989"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0989"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0989"
},
{
"url": "https://ubuntu.com/security/notices/USN-7974-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0989"
}
],
"published": "2026-01-15T15:15:52+00:00",
"updated": "2026-01-16T15:55:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0990",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
674
],
"description": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0990"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0990"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0990"
},
{
"url": "https://ubuntu.com/security/notices/USN-7974-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0990"
}
],
"published": "2026-01-15T15:15:52+00:00",
"updated": "2026-01-16T15:55:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-0992",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
400
],
"description": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-0992"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-0992"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0992"
},
{
"url": "https://ubuntu.com/security/notices/USN-7974-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0992"
}
],
"published": "2026-01-15T15:15:52+00:00",
"updated": "2026-01-16T15:55:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1484",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 4.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1484"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1484"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433259"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3870"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1484"
},
{
"url": "https://ubuntu.com/security/notices/USN-8017-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1484"
}
],
"published": "2026-01-27T14:15:56+00:00",
"updated": "2026-03-19T10:16:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1485",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.8,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
124
],
"description": "A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1485"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1485"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485"
},
{
"url": "https://ubuntu.com/security/notices/USN-8017-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1485"
}
],
"published": "2026-01-27T14:15:56+00:00",
"updated": "2026-03-18T17:16:05+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1489",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
787
],
"description": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1489"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1489"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433348"
},
{
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3872"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1489"
},
{
"url": "https://ubuntu.com/security/notices/USN-8017-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1489"
}
],
"published": "2026-01-27T15:15:57+00:00",
"updated": "2026-03-19T10:16:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.56.4-168.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glib2@2.56.4-168.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1757",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
401
],
"description": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1757"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1757"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940"
},
{
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1757"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1757"
}
],
"published": "2026-02-02T13:15:58+00:00",
"updated": "2026-03-12T13:16:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.9.7-21.el8_10.3",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libxml2@2.9.7-21.el8_10.3?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-1965",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
305
],
"description": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-1965"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-1965"
},
{
"url": "https://curl.se/docs/CVE-2026-1965.html"
},
{
"url": "https://curl.se/docs/CVE-2026-1965.json"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1965"
}
],
"published": "2026-03-11T11:15:59+00:00",
"updated": "2026-03-12T14:11:19+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-22185",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125,
191
],
"description": "OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-22185"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-22185"
},
{
"url": "https://bugs.openldap.org/show_bug.cgi?id=10421"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22185"
},
{
"url": "https://seclists.org/fulldisclosure/2026/Jan/5"
},
{
"url": "https://seclists.org/fulldisclosure/2026/Jan/8"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22185"
},
{
"url": "https://www.openldap.org/"
},
{
"url": "https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline"
}
],
"published": "2026-01-07T21:16:01+00:00",
"updated": "2026-01-14T18:16:42+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.4.46-21.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openldap@2.4.46-21.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-22795",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
754
],
"description": "Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-22795"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-22795"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
},
{
"url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"
},
{
"url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"
},
{
"url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"
},
{
"url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-22795.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22795"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22795"
}
],
"published": "2026-01-27T16:16:35+00:00",
"updated": "2026-02-02T18:41:14+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-22796",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "medium"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "medium"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
754
],
"description": "Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-22796"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1473"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-22796"
},
{
"url": "https://bugzilla.redhat.com/2430375"
},
{
"url": "https://bugzilla.redhat.com/2430376"
},
{
"url": "https://bugzilla.redhat.com/2430377"
},
{
"url": "https://bugzilla.redhat.com/2430378"
},
{
"url": "https://bugzilla.redhat.com/2430379"
},
{
"url": "https://bugzilla.redhat.com/2430380"
},
{
"url": "https://bugzilla.redhat.com/2430381"
},
{
"url": "https://bugzilla.redhat.com/2430386"
},
{
"url": "https://bugzilla.redhat.com/2430387"
},
{
"url": "https://bugzilla.redhat.com/2430388"
},
{
"url": "https://bugzilla.redhat.com/2430389"
},
{
"url": "https://bugzilla.redhat.com/2430390"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430375"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430376"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430377"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430378"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430379"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430380"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430381"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430386"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430387"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430388"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430389"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430390"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11187"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15467"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15468"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15469"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66199"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68160"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69418"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69419"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69420"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-69421"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22795"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22796"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1473.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:1472"
},
{
"url": "https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4"
},
{
"url": "https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49"
},
{
"url": "https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12"
},
{
"url": "https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e"
},
{
"url": "https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-22796.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-50081.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22796"
},
{
"url": "https://openssl-library.org/news/secadv/20260127.txt"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-7980-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22796"
}
],
"published": "2026-01-27T16:16:35+00:00",
"updated": "2026-02-02T18:40:27+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)"
}
},
{
"id": "CVE-2026-2297",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
668
],
"description": "The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-2297"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/05/6"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-2297"
},
{
"url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e"
},
{
"url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e"
},
{
"url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86"
},
{
"url": "https://github.com/python/cpython/issues/145506"
},
{
"url": "https://github.com/python/cpython/pull/145507"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2297"
}
],
"published": "2026-03-04T23:16:10+00:00",
"updated": "2026-03-12T15:16:27+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-23949",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 8.6,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 8.6,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
22
],
"description": "jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.",
"recommendation": "Upgrade jaraco.context to version 6.1.0",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-23949"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-23949"
},
{
"url": "https://github.com/jaraco/jaraco.context"
},
{
"url": "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91"
},
{
"url": "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9"
},
{
"url": "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2"
},
{
"url": "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23949"
},
{
"url": "https://ubuntu.com/security/notices/USN-7979-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23949"
}
],
"published": "2026-01-20T01:15:57+00:00",
"updated": "2026-03-11T23:12:19+00:00",
"affects": [
{
"ref": "pkg:pypi/jaraco.context@5.3.0",
"versions": [
{
"version": "5.3.0",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:pypi/jaraco.context@5.3.0"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:pypi/jaraco.context@5.3.0"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-24049",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
},
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "amazon"
},
"severity": "high"
},
{
"source": {
"name": "ghsa"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
}
],
"cwes": [
22,
732
],
"description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.",
"recommendation": "Upgrade wheel to version 0.46.2",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24049"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:1939"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24049"
},
{
"url": "https://bugzilla.redhat.com/2431959"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431959"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-1939.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:2090"
},
{
"url": "https://github.com/pypa/wheel"
},
{
"url": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"
},
{
"url": "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e"
},
{
"url": "https://github.com/pypa/wheel/releases/tag/0.46.2"
},
{
"url": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-24049.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-2090.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24049"
}
],
"published": "2026-01-22T05:16:23+00:00",
"updated": "2026-02-18T14:56:48+00:00",
"affects": [
{
"ref": "pkg:pypi/wheel@0.45.1",
"versions": [
{
"version": "0.45.1",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:pypi/wheel@0.45.1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:pypi/wheel@0.45.1"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-24281",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "bitnami"
},
"score": 7.4,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "ghsa"
},
"score": 7.4,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 7.4,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 7.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"cwes": [
295,
350
],
"description": "Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certificate for the PTR name. It's important to note that attacker must present a certificate which is trusted by ZKTrustManager which makes the attack vector harder to exploit. Users are recommended to upgrade to version 3.8.6 or 3.9.5, which fixes this issue by introducing a new configuration option to disable reverse DNS lookup in client and quorum protocols.",
"recommendation": "Upgrade org.apache.zookeeper:zookeeper to version 3.8.6, 3.9.5",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24281"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/07/4"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24281"
},
{
"url": "https://github.com/apache/zookeeper"
},
{
"url": "https://github.com/apache/zookeeper/commit/66c4efecdda1302d9cfb3af9eedb122b74452bf3"
},
{
"url": "https://issues.apache.org/jira/browse/ZOOKEEPER-4986"
},
{
"url": "https://lists.apache.org/thread/088ddsbrzhd5lxzbqf5n24yg0mwh9jt2"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24281"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24281"
}
],
"published": "2026-03-07T09:16:07+00:00",
"updated": "2026-03-10T18:18:17+00:00",
"affects": [
{
"ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.4",
"versions": [
{
"version": "3.8.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#be4d18e5-f375-4c9b-9ca2-cdec1a1e379f"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#2f854909-062a-4904-aa45-b6ea7ff69ad9"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#2aede9db-b9a8-4a51-bcc4-935292e3cc8e"
},
{
"ref": "urn:cdx:2d2b485c-1327-46ae-a1c3-e33faaf82d6a/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#98cc3eb7-ad88-436f-b360-5f1f67b6daaa"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#2ff9034c-064d-4add-9053-24c655ccf8fe"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#1fee3969-1dfe-48aa-8cc7-0cc8e85bdae2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#05587ed4-5bd4-494a-b05d-0ea4cfe96219"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#193483c2-0225-4ec4-a134-48e4ef43c2c3"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#9d70e05e-38f3-4a3c-a5aa-cf189247cea2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#07aadf55-77f2-4da0-95db-0afa73c20436"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#05dd044e-c9f4-41d6-a6c3-85eec11068b5"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#379e3d4b-d84f-4578-8ff3-ad2bea297a29"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#b50935f1-0c22-4fa8-9282-1c797b872c1b"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#1017d64b-7104-4c9b-8803-a84a5951f90c"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0def54c4-37f4-4f51-aca8-25375975b48a"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#28e8c6bb-4586-42ee-99bb-d9ca4ffc8d66"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0cb1477e-0374-4d77-b593-51250f5a54a9"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#298040d0-6ecf-4d02-b151-8bd326ca96c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#86e3a19f-9451-4144-b9a5-f472e76b2965"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-24308",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "bitnami"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"cwes": [
532
],
"description": "Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue.\u00a0Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.",
"recommendation": "Upgrade org.apache.zookeeper:zookeeper to version 3.9.5, 3.8.6",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24308"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/07/5"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24308"
},
{
"url": "https://github.com/apache/zookeeper"
},
{
"url": "https://github.com/apache/zookeeper/releases/tag/release-3.8.6"
},
{
"url": "https://github.com/apache/zookeeper/releases/tag/release-3.9.5"
},
{
"url": "https://lists.apache.org/thread/qng3rtzv2pqkmko4rhv85jfplkyrgqdr"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24308"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24308"
}
],
"published": "2026-03-07T09:16:07+00:00",
"updated": "2026-03-10T18:18:27+00:00",
"affects": [
{
"ref": "pkg:maven/org.apache.zookeeper/zookeeper@3.8.4",
"versions": [
{
"version": "3.8.4",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#be4d18e5-f375-4c9b-9ca2-cdec1a1e379f"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#2f854909-062a-4904-aa45-b6ea7ff69ad9"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#2aede9db-b9a8-4a51-bcc4-935292e3cc8e"
},
{
"ref": "urn:cdx:2d2b485c-1327-46ae-a1c3-e33faaf82d6a/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#98cc3eb7-ad88-436f-b360-5f1f67b6daaa"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#2ff9034c-064d-4add-9053-24c655ccf8fe"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#1fee3969-1dfe-48aa-8cc7-0cc8e85bdae2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#05587ed4-5bd4-494a-b05d-0ea4cfe96219"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#193483c2-0225-4ec4-a134-48e4ef43c2c3"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#9d70e05e-38f3-4a3c-a5aa-cf189247cea2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#07aadf55-77f2-4da0-95db-0afa73c20436"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#05dd044e-c9f4-41d6-a6c3-85eec11068b5"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#379e3d4b-d84f-4578-8ff3-ad2bea297a29"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/org.apache.zookeeper/zookeeper@3.8.4"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#b50935f1-0c22-4fa8-9282-1c797b872c1b"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#1017d64b-7104-4c9b-8803-a84a5951f90c"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0def54c4-37f4-4f51-aca8-25375975b48a"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#28e8c6bb-4586-42ee-99bb-d9ca4ffc8d66"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0cb1477e-0374-4d77-b593-51250f5a54a9"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#298040d0-6ecf-4d02-b151-8bd326ca96c1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#86e3a19f-9451-4144-b9a5-f472e76b2965"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-24515",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 2.5,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "photon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 2.9,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
476
],
"description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24515"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24515"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1131"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24515"
},
{
"url": "https://ubuntu.com/security/notices/USN-8022-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8022-2"
},
{
"url": "https://ubuntu.com/security/notices/USN-8023-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24515"
}
],
"published": "2026-01-23T08:16:01+00:00",
"updated": "2026-02-05T17:27:53+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-1.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-24883",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
476
],
"description": "In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-24883"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-24883"
},
{
"url": "https://dev.gnupg.org/T8049"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24883"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-24883"
},
{
"url": "https://www.openwall.com/lists/oss-security/2026/01/27/8"
}
],
"published": "2026-01-27T19:16:16+00:00",
"updated": "2026-02-06T18:06:07+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.2.20-4.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/gnupg2@2.2.20-4.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-25645",
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 4.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"cwes": [
377
],
"description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.",
"recommendation": "; Upgrade requests to version 2.33.0",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-25645"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-25645"
},
{
"url": "https://github.com/psf/requests"
},
{
"url": "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"
},
{
"url": "https://github.com/psf/requests/releases/tag/v2.33.0"
},
{
"url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25645"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25645"
}
],
"published": "2026-03-25T17:16:52+00:00",
"updated": "2026-03-30T14:23:16+00:00",
"affects": [
{
"ref": "pkg:pypi/requests@2.32.5",
"versions": [
{
"version": "2.32.5",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "9.0.3-24.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:pypi/requests@2.32.5"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python-pip@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-pip-wheel@9.0.3-24.el8?arch=noarch&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-2673",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "low"
},
{
"source": {
"name": "redhat"
},
"score": 3.1,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
757
],
"description": "Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers. The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security. Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-2673"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/13/3"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-2673"
},
{
"url": "https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f"
},
{
"url": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2673"
},
{
"url": "https://openssl-library.org/news/secadv/20260313.txt"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2673"
}
],
"published": "2026-03-13T19:54:34+00:00",
"updated": "2026-03-17T18:16:15+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1",
"versions": [
{
"version": "1:1.1.1k-15.el8_6",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl-libs@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/openssl@1.1.1k-15.el8_6?arch=x86_64&distro=redhat-8.10&epoch=1"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-27135",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
617
],
"description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-27135"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/20/3"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-27135"
},
{
"url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
},
{
"url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
}
],
"published": "2026-03-18T18:16:26+00:00",
"updated": "2026-03-23T17:51:17+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.33.0-6.el8_10.1",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libnghttp2@1.33.0-6.el8_10.1?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-27171",
"ratings": [
{
"source": {
"name": "azure"
},
"severity": "low"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
1284
],
"description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-27171"
},
{
"url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/"
},
{
"url": "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-27171"
},
{
"url": "https://github.com/madler/zlib/issues/904"
},
{
"url": "https://github.com/madler/zlib/releases/tag/v1.3.2"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171"
},
{
"url": "https://ostif.org/zlib-audit-complete/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27171"
}
],
"published": "2026-02-18T04:16:01+00:00",
"updated": "2026-03-25T21:27:04+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "1.2.11-25.el8",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/zlib@1.2.11-25.el8?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-29111",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 7.8,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
269
],
"description": "systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-29111"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
},
{
"url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
},
{
"url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
},
{
"url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
},
{
"url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
},
{
"url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
},
{
"url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
},
{
"url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
},
{
"url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
},
{
"url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
},
{
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"url": "https://ubuntu.com/security/notices/USN-8119-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8119-2"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
}
],
"published": "2026-03-23T22:16:26+00:00",
"updated": "2026-03-24T15:53:48+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-32776",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 6.2,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
476
],
"description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32776"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32776"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1158"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1159"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32776"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32776"
}
],
"published": "2026-03-16T14:19:44+00:00",
"updated": "2026-03-17T15:52:09+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-1.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-32777",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"cwes": [
835
],
"description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32777"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32777"
},
{
"url": "https://github.com/libexpat/libexpat/issues/1161"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1159"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1162"
},
{
"url": "https://issues.oss-fuzz.com/issues/486993411"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32777"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32777"
}
],
"published": "2026-03-16T14:19:44+00:00",
"updated": "2026-03-17T15:52:34+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-1.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-32778",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "nvd"
},
"score": 5.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.1,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
476
],
"description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-32778"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-32778"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1159"
},
{
"url": "https://github.com/libexpat/libexpat/pull/1163"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32778"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32778"
}
],
"published": "2026-03-16T14:19:44+00:00",
"updated": "2026-03-17T15:52:53+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.5.0-1.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/expat@2.5.0-1.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-33056",
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 4.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
61
],
"description": "tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory \u2014 and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-33056"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33056"
},
{
"url": "https://github.com/alexcrichton/tar-rs"
},
{
"url": "https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446"
},
{
"url": "https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33056"
},
{
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html"
},
{
"url": "https://ubuntu.com/security/notices/USN-8138-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8139-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33056"
}
],
"published": "2026-03-20T08:16:11+00:00",
"updated": "2026-03-24T16:17:11+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2",
"versions": [
{
"version": "2:1.30-11.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/tar@1.30-11.el8_10?arch=x86_64&distro=redhat-8.10&epoch=2"
}
]
},
{
"id": "CVE-2026-3479",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 3.3,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
22
],
"description": "pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3479"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3479"
},
{
"url": "https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7"
},
{
"url": "https://github.com/python/cpython/issues/146121"
},
{
"url": "https://github.com/python/cpython/pull/146122"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3479"
}
],
"published": "2026-03-18T19:16:06+00:00",
"updated": "2026-03-19T18:16:22+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-3644",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.4,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
],
"cwes": [
20,
116
],
"description": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3644"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3644"
},
{
"url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4"
},
{
"url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd"
},
{
"url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd"
},
{
"url": "https://github.com/python/cpython/issues/145599"
},
{
"url": "https://github.com/python/cpython/pull/145600"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3644"
}
],
"published": "2026-03-16T18:16:09+00:00",
"updated": "2026-03-17T14:20:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3731",
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
119,
125
],
"description": "A weakness has been identified in libssh up to 0.11.3. The impacted element is the function sftp_extensions_get_name/sftp_extensions_get_data of the file src/sftp.c of the component SFTP Extension Name Handler. Executing a manipulation of the argument idx can lead to out-of-bounds read. The attack may be performed from remote. Upgrading to version 0.11.4 and 0.12.0 is sufficient to resolve this issue. This patch is called 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60. You should upgrade the affected component.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3731"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3731"
},
{
"url": "https://gitlab.com/libssh/libssh-mirror/-/commit/855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3731"
},
{
"url": "https://ubuntu.com/security/notices/USN-8093-1"
},
{
"url": "https://vuldb.com/?ctiid.349709"
},
{
"url": "https://vuldb.com/?id.349709"
},
{
"url": "https://vuldb.com/?submit.767120"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3731"
},
{
"url": "https://www.libssh.org/files/0.12/libssh-0.12.0.tar.xz"
},
{
"url": "https://www.libssh.org/security/advisories/libssh-2026-sftp-extensions.txt"
}
],
"published": "2026-03-08T11:15:50+00:00",
"updated": "2026-03-12T19:02:31+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "0.9.6-16.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh-config@0.9.6-16.el8_10?arch=noarch&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libssh@0.9.6-16.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3783",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
522
],
"description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3783"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/2"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3783"
},
{
"url": "https://curl.se/docs/CVE-2026-3783.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3783.json"
},
{
"url": "https://hackerone.com/reports/3583983"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3783"
}
],
"published": "2026-03-11T11:16:00+00:00",
"updated": "2026-03-12T14:10:37+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3784",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "low"
}
],
"cwes": [
305
],
"description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3784"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/3"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3784"
},
{
"url": "https://curl.se/docs/CVE-2026-3784.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3784.json"
},
{
"url": "https://hackerone.com/reports/3584903"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://ubuntu.com/security/notices/USN-8099-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3784"
}
],
"published": "2026-03-11T11:16:00+00:00",
"updated": "2026-03-12T14:09:50+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-3805",
"ratings": [
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 6.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
416
],
"description": "When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-3805"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/11/4"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-3805"
},
{
"url": "https://curl.se/docs/CVE-2026-3805.html"
},
{
"url": "https://curl.se/docs/CVE-2026-3805.json"
},
{
"url": "https://hackerone.com/reports/3591944"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805"
},
{
"url": "https://ubuntu.com/security/notices/USN-8084-1"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-3805"
}
],
"published": "2026-03-11T11:16:00+00:00",
"updated": "2026-03-12T14:08:56+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "7.61.1-34.el8_10.9",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/curl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libcurl@7.61.1-34.el8_10.9?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4046",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
617
],
"description": "The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.\n\n\n\nThis vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4046"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4046"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4046"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33980"
},
{
"url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4046"
}
],
"published": "2026-03-30T18:16:19+00:00",
"updated": "2026-04-01T14:24:21+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-4105",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"cwes": [
284
],
"description": "A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4105"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4105"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447262"
},
{
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4105"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4105"
}
],
"published": "2026-03-13T19:55:13+00:00",
"updated": "2026-03-16T14:53:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "239-82.el8_10.13",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-libs@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd-pam@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/systemd@239-82.el8_10.13?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4111",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "rocky"
},
"severity": "high"
}
],
"cwes": [
835
],
"description": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4111"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5063"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:5080"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"url": "https://bugzilla.redhat.com/2446453"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
},
{
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4111"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-5080.html"
},
{
"url": "https://errata.rockylinux.org/RLSA-2026:5063"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2877"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-4111.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-5080.html"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
}
],
"published": "2026-03-13T19:55:13+00:00",
"updated": "2026-03-19T12:16:18+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "in_triage",
"justification": "",
"response": [],
"detail": "This CVE is under investigation by Confluent."
}
},
{
"id": "CVE-2026-4224",
"ratings": [
{
"source": {
"name": "amazon"
},
"severity": "medium"
},
{
"source": {
"name": "redhat"
},
"score": 5.9,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
674
],
"description": "When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4224"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/16/4"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4224"
},
{
"url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a"
},
{
"url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3"
},
{
"url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768"
},
{
"url": "https://github.com/python/cpython/issues/145986"
},
{
"url": "https://github.com/python/cpython/pull/145987"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4224"
}
],
"published": "2026-03-16T18:16:10+00:00",
"updated": "2026-03-17T14:20:01+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2026-4424",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
125
],
"description": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4424"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4424"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2898"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4424"
}
],
"published": "2026-03-19T15:16:28+00:00",
"updated": "2026-03-20T13:39:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-4426",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1335
],
"description": "A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4426"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4426"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449010"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2897"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4426"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4426"
}
],
"published": "2026-03-19T15:16:28+00:00",
"updated": "2026-03-20T13:39:46+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-4437",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 6.5,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
}
],
"cwes": [
125
],
"description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4437"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4437"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4437"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34014"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4437"
}
],
"published": "2026-03-20T20:16:49+00:00",
"updated": "2026-03-23T16:16:51+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-4438",
"ratings": [
{
"source": {
"name": "redhat"
},
"score": 4,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"cwes": [
20,
88
],
"description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4438"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4438"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4438"
},
{
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34015"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4438"
}
],
"published": "2026-03-20T20:16:49+00:00",
"updated": "2026-03-23T15:16:35+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "2.28-251.el8_10.27",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-common@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc-minimal-langpack@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/glibc@2.28-251.el8_10.27?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-4519",
"ratings": [
{
"source": {
"name": "alma"
},
"severity": "high"
},
{
"source": {
"name": "azure"
},
"severity": "high"
},
{
"source": {
"name": "cbl-mariner"
},
"severity": "high"
},
{
"source": {
"name": "oracle-oval"
},
"severity": "high"
},
{
"source": {
"name": "photon"
},
"severity": "high"
},
{
"source": {
"name": "redhat"
},
"score": 7.1,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L"
}
],
"cwes": [
20
],
"description": "The webbrowser.open() API would accept leading dashes in the URL which \ncould be handled as command line options for certain web browsers. New \nbehavior rejects leading dashes. Users are recommended to sanitize URLs \nprior to passing to webbrowser.open().",
"recommendation": "Upgrade platform-python to version 3.6.8-75.el8_10; Upgrade python3-libs to version 3.6.8-75.el8_10",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-4519"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/03/20/1"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:6286"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"url": "https://bugzilla.redhat.com/2449649"
},
{
"url": "https://errata.almalinux.org/9/ALSA-2026-6286.html"
},
{
"url": "https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866"
},
{
"url": "https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b"
},
{
"url": "https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76"
},
{
"url": "https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5"
},
{
"url": "https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48"
},
{
"url": "https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03"
},
{
"url": "https://github.com/python/cpython/issues/143930"
},
{
"url": "https://github.com/python/cpython/pull/143931"
},
{
"url": "https://linux.oracle.com/cve/CVE-2026-4519.html"
},
{
"url": "https://linux.oracle.com/errata/ELSA-2026-6286.html"
},
{
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
}
],
"published": "2026-03-20T15:16:24+00:00",
"updated": "2026-03-25T18:16:33+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.6.8-73.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/platform-python@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/python3-libs@3.6.8-73.el8_10?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "CVE-2026-5121",
"ratings": [
{
"source": {
"name": "redhat"
},
"severity": "medium"
}
],
"cwes": [
190
],
"description": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-5121"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-5121"
},
{
"url": "https://github.com/libarchive/libarchive/pull/2934"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5121"
}
],
"published": "2026-03-30T08:16:18+00:00",
"updated": "2026-03-31T15:16:22+00:00",
"affects": [
{
"ref": "pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10",
"versions": [
{
"version": "3.3.3-6.el8_10",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#pkg:rpm/redhat/libarchive@3.3.3-6.el8_10?arch=x86_64&distro=redhat-8.10"
}
]
},
{
"id": "GHSA-72hv-8253-57qq",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [],
"description": "### Summary\nThe non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).\n\nThe standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.\n\n### Details\nThe root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.\n\n- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks.\n- After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`.\n- The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed.\n- Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.\n\n### PoC\nThe following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.\n\n```java\npackage tools.jackson.core.unittest.dos;\n\nimport java.nio.charset.StandardCharsets;\n\nimport org.junit.jupiter.api.Test;\n\nimport tools.jackson.core.*;\nimport tools.jackson.core.exc.StreamConstraintsException;\nimport tools.jackson.core.json.JsonFactory;\nimport tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;\n\nimport static org.junit.jupiter.api.Assertions.*;\n\n/**\n * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers\n *\n * Authors: sprabhav7, rohan-repos\n * \n * maxNumberLength default = 1000 characters (digits).\n * A number with more than 1000 digits should be rejected by any parser.\n *\n * BUG: The async parser never calls resetInt()/resetFloat() which is where\n * validateIntegerLength()/validateFPLength() lives. Instead it calls\n * _valueComplete() which skips all number length validation.\n *\n * CWE-770: Allocation of Resources Without Limits or Throttling\n */\nclass AsyncParserNumberLengthBypassTest {\n\n private static final int MAX_NUMBER_LENGTH = 1000;\n private static final int TEST_NUMBER_LENGTH = 5000;\n\n private final JsonFactory factory = new JsonFactory();\n\n // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength\n @Test\n void syncParserRejectsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\t\t\n\t\t// Output to console\n System.out.println(\"[SYNC] Parsing \" + TEST_NUMBER_LENGTH + \"-digit number (limit: \" + MAX_NUMBER_LENGTH + \")\");\n try {\n try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n System.out.println(\"[SYNC] Accepted number with \" + p.getText().length() + \" digits \u2014 UNEXPECTED\");\n }\n }\n }\n fail(\"Sync parser must reject a \" + TEST_NUMBER_LENGTH + \"-digit number\");\n } catch (StreamConstraintsException e) {\n System.out.println(\"[SYNC] Rejected with StreamConstraintsException: \" + e.getMessage());\n }\n }\n\n // VULNERABILITY: Async parser accepts the SAME number that sync rejects\n @Test\n void asyncParserAcceptsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\n NonBlockingByteArrayJsonParser p =\n (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());\n p.feedInput(payload, 0, payload.length);\n p.endOfInput();\n\n boolean foundNumber = false;\n try {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n foundNumber = true;\n String numberText = p.getText();\n assertEquals(TEST_NUMBER_LENGTH, numberText.length(),\n \"Async parser silently accepted all \" + TEST_NUMBER_LENGTH + \" digits\");\n }\n }\n // Output to console\n System.out.println(\"[ASYNC INT] Accepted number with \" + TEST_NUMBER_LENGTH + \" digits \u2014 BUG CONFIRMED\");\n assertTrue(foundNumber, \"Parser should have produced a VALUE_NUMBER_INT token\");\n } catch (StreamConstraintsException e) {\n fail(\"Bug is fixed \u2014 async parser now correctly rejects long numbers: \" + e.getMessage());\n }\n p.close();\n }\n\n private byte[] buildPayloadWithLongInteger(int numDigits) {\n StringBuilder sb = new StringBuilder(numDigits + 10);\n sb.append(\"{\\\"v\\\":\");\n for (int i = 0; i < numDigits; i++) {\n sb.append((char) ('1' + (i % 9)));\n }\n sb.append('}');\n return sb.toString().getBytes(StandardCharsets.UTF_8);\n }\n}\n\n```\n\n\n### Impact\nA malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause:\n1. **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`.\n2. **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS.\n\n### Suggested Remediation\n\nThe async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers.\n\n**NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)",
"recommendation": "Upgrade com.fasterxml.jackson.core:jackson-core to version 2.18.6, 2.21.1, 3.1.0",
"advisories": [
{
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"url": "https://github.com/FasterXML/jackson-core"
},
{
"url": "https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf"
},
{
"url": "https://github.com/FasterXML/jackson-core/pull/1555"
},
{
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq"
}
],
"published": "2026-02-28T02:01:05+00:00",
"updated": "2026-03-27T14:26:32+00:00",
"affects": [
{
"ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0",
"versions": [
{
"version": "2.16.0",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#0cd534a8-0653-45a2-9075-0eeca34e6de9"
},
{
"ref": "urn:cdx:de542131-bf89-4836-af64-71af6c7f7e84/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#2330d701-b5a9-46c9-84da-9f77404a7af8"
},
{
"ref": "urn:cdx:552e09d7-866e-4874-a594-d7448fefc3d8/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#099beec0-45d7-42ea-a1f2-4786368132ba"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:2d2b485c-1327-46ae-a1c3-e33faaf82d6a/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:cc04042b-dc8f-42a7-b8c1-857069006ad0/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#0edbc5a5-a263-424e-bcef-b8b23b8bb3b0"
},
{
"ref": "urn:cdx:afd8c1a3-91a8-4115-8a61-99ca19f4f9df/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#0ea925d8-484e-4979-8f48-69e10e8a1f1c"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:cea6b37d-c537-40b7-9ec2-88fa23451633/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#4d54e9c5-c325-43d1-b6a6-57744f87073b"
},
{
"ref": "urn:cdx:3e67727c-17f2-4324-96c1-6f4010e0d2a8/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:34a9bf7c-cd26-4c4a-a075-c4b25475c6cd/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#2a1821b9-f834-40cd-9df6-da687fe78827"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#1389f63b-2b68-4eae-a284-1e83342e6d11"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#00f89915-0744-44da-9131-79eb79817943"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#0913081a-f61a-41bd-89e0-4d8169c89997"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#8fcd3861-407d-4705-b037-9085403ddd9b"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#03b1cf11-9d1b-4cab-90a1-95e5730e126d"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#11ac841c-157a-4423-8e8d-aaca3bebe27d"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#0f16088f-e6f2-4831-912e-3866aeb47c1c"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#236a0d80-0a14-41c1-a0de-9f616eb9b595"
},
{
"ref": "urn:cdx:5f677f75-bc8c-4721-bf3a-c789f1f706b9/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#0298aaf0-2224-413f-bea5-ea431d962ccf"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#18933e6d-15bf-443d-8abd-612689ce7078"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#18c4415c-b51d-4a37-975a-801ef3b58af0"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#1de25f9d-ce5e-48c6-bdc0-10187d463607"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#054f13b7-2f76-4e18-ab07-32264600f7ac"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#08b804a9-1317-4496-bd97-17fe6b9ceea8"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#3482cb39-6184-45e4-b859-5876cd70e498"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#04852d11-590c-47ed-9539-dba5d40abec5"
}
],
"analysis": {
"state": "not_affected",
"justification": "",
"response": [
"update"
],
"detail": null
}
},
{
"id": "CVE-2024-6763",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 3.7,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "nvd"
},
"score": 5.3,
"severity": "medium",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 3.7,
"severity": "low",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
},
{
"source": {
"name": "ubuntu"
},
"severity": "medium"
}
],
"cwes": [
1286
],
"description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC. Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.",
"recommendation": "Upgrade org.eclipse.jetty:jetty-http to version 12.0.12",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2024-6763"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-6763"
},
{
"url": "https://github.com/jetty/jetty.project"
},
{
"url": "https://github.com/jetty/jetty.project/pull/12012"
},
{
"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh"
},
{
"url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6763"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250306-0005"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250306-0005/"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6763"
}
],
"published": "2024-10-14T16:15:04+00:00",
"updated": "2025-07-10T15:04:04+00:00",
"affects": [
{
"ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.59",
"versions": [
{
"version": "9.4.59",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/org.eclipse.jetty/jetty-http@9.4.59",
"versions": [
{
"version": "9.4.59",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#bbbabd96-c6a4-45dc-96ec-eb14df455414"
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#bbbabd96-c6a4-45dc-96ec-eb14df455414"
},
{
"ref": "urn:cdx:de542131-bf89-4836-af64-71af6c7f7e84/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:de542131-bf89-4836-af64-71af6c7f7e84/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#68befbf6-2f6a-4450-af60-7e56b4e22ca0"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#68befbf6-2f6a-4450-af60-7e56b4e22ca0"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:cc04042b-dc8f-42a7-b8c1-857069006ad0/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:cc04042b-dc8f-42a7-b8c1-857069006ad0/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#444d95d3-d646-415c-8067-6d60153c013d"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#444d95d3-d646-415c-8067-6d60153c013d"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#2d7a724e-124f-4de8-b7e7-aa36e77127d1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#2d7a724e-124f-4de8-b7e7-aa36e77127d1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#11d699ad-e5d0-4b7b-82fa-63d311e55966"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#11d699ad-e5d0-4b7b-82fa-63d311e55966"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#4859e2bc-001d-41de-8a1d-8c67bb857c34"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#4859e2bc-001d-41de-8a1d-8c67bb857c34"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#15ebda4e-da80-456d-83dc-41f7ce6b7f5e"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#15ebda4e-da80-456d-83dc-41f7ce6b7f5e"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#00a1878c-3df4-48e1-a3e0-53da33eb15b5"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#00a1878c-3df4-48e1-a3e0-53da33eb15b5"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#22c010ba-a839-4845-9c83-6d93b69606b3"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#22c010ba-a839-4845-9c83-6d93b69606b3"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#4ba5bee1-3144-4cb5-9f5c-7aae720ef10c"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#4ba5bee1-3144-4cb5-9f5c-7aae720ef10c"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#3f8337cc-4195-4855-add3-22c2709641b4"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#3f8337cc-4195-4855-add3-22c2709641b4"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#0fd211b4-36bd-4a85-9539-b676343efe88"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#0fd211b4-36bd-4a85-9539-b676343efe88"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#027b6430-db36-4b64-b8cb-30590d703489"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#027b6430-db36-4b64-b8cb-30590d703489"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#003ae15e-7915-467a-8fe6-f1ffc5148313"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#003ae15e-7915-467a-8fe6-f1ffc5148313"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#0b9427b8-6a85-4165-9e57-dc3eab35eef7"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#0b9427b8-6a85-4165-9e57-dc3eab35eef7"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0f501729-e743-4846-9efa-f2d01af76346"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0f501729-e743-4846-9efa-f2d01af76346"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:maven/org.eclipse.jetty/jetty-http@9.4.59"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#5a939a42-588d-474a-bb05-95c0acf4b9c4"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#5a939a42-588d-474a-bb05-95c0acf4b9c4"
}
],
"analysis": {
"state": "not_affected",
"justification": "code_not_reachable",
"response": [
"update"
],
"detail": "This vulnerability is not exploitable in the context of Confluent Platform as URIs are not used to pass sensitive information. "
}
},
{
"id": "CVE-2025-67030",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"severity": "high"
},
{
"source": {
"name": "nvd"
},
"score": 8.8,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 8.3,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
}
],
"cwes": [
22
],
"description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code",
"recommendation": "Upgrade org.codehaus.plexus:plexus-utils to version 4.0.3",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2025-67030"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2025-67030"
},
{
"url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec"
},
{
"url": "https://github.com/codehaus-plexus/plexus-utils"
},
{
"url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642"
},
{
"url": "https://github.com/codehaus-plexus/plexus-utils/issues/294"
},
{
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/295"
},
{
"url": "https://github.com/codehaus-plexus/plexus-utils/pull/296"
},
{
"url": "https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2025-67030"
}
],
"published": "2026-03-25T18:16:25+00:00",
"updated": "2026-04-01T14:15:59+00:00",
"affects": [
{
"ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1",
"versions": [
{
"version": "3.3.1",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1",
"versions": [
{
"version": "3.3.1",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#44fb2f76-b271-496e-948a-4f6d9823fffd"
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#44fb2f76-b271-496e-948a-4f6d9823fffd"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#2c35a000-741d-477e-88ad-cda7f063b0cf"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#2c35a000-741d-477e-88ad-cda7f063b0cf"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:5a364b9f-d702-44af-8064-cea786957280/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#bb6c893a-9240-4539-a6f5-e2f888c5f49a"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#bb6c893a-9240-4539-a6f5-e2f888c5f49a"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#34ea74dc-7104-4558-915d-72b8e8c43b70"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#34ea74dc-7104-4558-915d-72b8e8c43b70"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:b842d97f-af27-4efa-86d0-c0e3cb66ab47/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#5fccc09a-fa6b-4ee6-af8b-c6947688cd33"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#5fccc09a-fa6b-4ee6-af8b-c6947688cd33"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#16ae30d7-8539-4d4a-b94a-a9845b52f48f"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#16ae30d7-8539-4d4a-b94a-a9845b52f48f"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#09f68b8c-b553-4220-91a6-8f8c399d1c21"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#09f68b8c-b553-4220-91a6-8f8c399d1c21"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:258b9465-2fe4-4da3-9d7c-9ac21aea9c82/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#0e99339e-209d-4238-9edd-1b2636f133bd"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#0e99339e-209d-4238-9edd-1b2636f133bd"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#2bc862fd-1d42-4401-8fa2-109009358f16"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#2bc862fd-1d42-4401-8fa2-109009358f16"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#037ee001-b390-4fdd-9384-8d2ac13f136e"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#037ee001-b390-4fdd-9384-8d2ac13f136e"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#2b2fdd0f-ef86-4a40-a842-e4c82e38bbb0"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#2b2fdd0f-ef86-4a40-a842-e4c82e38bbb0"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#3cc392e0-6a35-459a-bfa8-27b6ee8221de"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#3cc392e0-6a35-459a-bfa8-27b6ee8221de"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0da2809e-700e-4984-9e91-8bdb6f49c500"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0da2809e-700e-4984-9e91-8bdb6f49c500"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#38410211-3180-4613-b28a-6fb0eb6bbec3"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#38410211-3180-4613-b28a-6fb0eb6bbec3"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#055b3800-1063-4334-9198-9d9c7aa359e1"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#055b3800-1063-4334-9198-9d9c7aa359e1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:c2eeb562-1c05-4261-936e-5902eea3e920/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.3.1"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#1be0d9e3-afa8-4bc2-acd8-d1551bcbd56d"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#1be0d9e3-afa8-4bc2-acd8-d1551bcbd56d"
}
]
},
{
"id": "CVE-2026-33870",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "ghsa"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"cwes": [
444
],
"description": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.",
"recommendation": "Upgrade io.netty:netty-codec-http to version 4.1.132.Final, 4.2.10.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-33870"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33870"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"url": "https://w4ke.info/2025/06/18/funky-chunks.html"
},
{
"url": "https://w4ke.info/2025/10/29/funky-chunks-2.html"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33870"
},
{
"url": "https://www.rfc-editor.org/rfc/rfc9110"
}
],
"published": "2026-03-27T20:16:34+00:00",
"updated": "2026-03-30T20:12:16+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
"versions": [
{
"version": "4.1.130.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
"versions": [
{
"version": "4.1.130.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
"versions": [
{
"version": "4.1.130.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final",
"versions": [
{
"version": "4.1.130.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#11208e98-c133-46e2-9732-a4f73571b800"
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#11208e98-c133-46e2-9732-a4f73571b800"
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#11208e98-c133-46e2-9732-a4f73571b800"
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#11208e98-c133-46e2-9732-a4f73571b800"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#229cc159-f3af-43b5-a3d6-2d2297db0f8e"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#229cc159-f3af-43b5-a3d6-2d2297db0f8e"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#229cc159-f3af-43b5-a3d6-2d2297db0f8e"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#229cc159-f3af-43b5-a3d6-2d2297db0f8e"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#299a91dd-3213-4c1f-987a-4acead3248f9"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#299a91dd-3213-4c1f-987a-4acead3248f9"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#299a91dd-3213-4c1f-987a-4acead3248f9"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#299a91dd-3213-4c1f-987a-4acead3248f9"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#03b2849f-e1ed-4749-8b78-9365fef0840b"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#03b2849f-e1ed-4749-8b78-9365fef0840b"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#03b2849f-e1ed-4749-8b78-9365fef0840b"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#03b2849f-e1ed-4749-8b78-9365fef0840b"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#89a2b586-aeaa-4a92-8334-3f1517758b44"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#89a2b586-aeaa-4a92-8334-3f1517758b44"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#89a2b586-aeaa-4a92-8334-3f1517758b44"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#89a2b586-aeaa-4a92-8334-3f1517758b44"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b9a6a070-3e30-4116-85f2-9b2b660fe381/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#4f1a35c8-f816-45f8-9d71-854101c1eb40"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#4f1a35c8-f816-45f8-9d71-854101c1eb40"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#4f1a35c8-f816-45f8-9d71-854101c1eb40"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#4f1a35c8-f816-45f8-9d71-854101c1eb40"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#447572ee-d30e-4c27-9bda-062fa94e17a4"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#447572ee-d30e-4c27-9bda-062fa94e17a4"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#447572ee-d30e-4c27-9bda-062fa94e17a4"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#447572ee-d30e-4c27-9bda-062fa94e17a4"
},
{
"ref": "urn:cdx:cea6b37d-c537-40b7-9ec2-88fa23451633/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:cea6b37d-c537-40b7-9ec2-88fa23451633/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:cea6b37d-c537-40b7-9ec2-88fa23451633/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:cea6b37d-c537-40b7-9ec2-88fa23451633/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#441449a3-85a2-403b-a2af-26da4ec02bc4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#441449a3-85a2-403b-a2af-26da4ec02bc4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#441449a3-85a2-403b-a2af-26da4ec02bc4"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#441449a3-85a2-403b-a2af-26da4ec02bc4"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#5730ac71-1afb-43e5-ace3-c3478c1fc695"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#5730ac71-1afb-43e5-ace3-c3478c1fc695"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#5730ac71-1afb-43e5-ace3-c3478c1fc695"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#5730ac71-1afb-43e5-ace3-c3478c1fc695"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#096079b9-c1c4-4225-8c14-d42ffba8742a"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#096079b9-c1c4-4225-8c14-d42ffba8742a"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#096079b9-c1c4-4225-8c14-d42ffba8742a"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#096079b9-c1c4-4225-8c14-d42ffba8742a"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#01f8c161-8ef4-439e-bc14-999a9b632e86"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#01f8c161-8ef4-439e-bc14-999a9b632e86"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#01f8c161-8ef4-439e-bc14-999a9b632e86"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#01f8c161-8ef4-439e-bc14-999a9b632e86"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#31a54f7a-ddc5-4f42-8df4-d2e639849ad9"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#31a54f7a-ddc5-4f42-8df4-d2e639849ad9"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#31a54f7a-ddc5-4f42-8df4-d2e639849ad9"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#31a54f7a-ddc5-4f42-8df4-d2e639849ad9"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#34f84176-cb6b-413e-b00a-e2fbcd4e8793"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#34f84176-cb6b-413e-b00a-e2fbcd4e8793"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#34f84176-cb6b-413e-b00a-e2fbcd4e8793"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#34f84176-cb6b-413e-b00a-e2fbcd4e8793"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#92f366d6-638c-468a-98f3-4facaec530be"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#92f366d6-638c-468a-98f3-4facaec530be"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#92f366d6-638c-468a-98f3-4facaec530be"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#92f366d6-638c-468a-98f3-4facaec530be"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#3cf34cd3-23aa-4937-bf35-14e68974ee96"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#3cf34cd3-23aa-4937-bf35-14e68974ee96"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#3cf34cd3-23aa-4937-bf35-14e68974ee96"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#3cf34cd3-23aa-4937-bf35-14e68974ee96"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#cc68cf30-13e8-4961-98fd-0e979dbdf359"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#cc68cf30-13e8-4961-98fd-0e979dbdf359"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#cc68cf30-13e8-4961-98fd-0e979dbdf359"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#cc68cf30-13e8-4961-98fd-0e979dbdf359"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#0b094275-472e-4883-b8db-f7147d55d727"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#0b094275-472e-4883-b8db-f7147d55d727"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#0b094275-472e-4883-b8db-f7147d55d727"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#0b094275-472e-4883-b8db-f7147d55d727"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#205a94fb-7763-47f1-854a-b9f65f0b6077"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#205a94fb-7763-47f1-854a-b9f65f0b6077"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#205a94fb-7763-47f1-854a-b9f65f0b6077"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#205a94fb-7763-47f1-854a-b9f65f0b6077"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0d99e6a5-0e29-4f6a-9d99-ce01d39b9068"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0d99e6a5-0e29-4f6a-9d99-ce01d39b9068"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0d99e6a5-0e29-4f6a-9d99-ce01d39b9068"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0d99e6a5-0e29-4f6a-9d99-ce01d39b9068"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#1f183219-6b96-4656-bb53-ed82b105ef02"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#1f183219-6b96-4656-bb53-ed82b105ef02"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#1f183219-6b96-4656-bb53-ed82b105ef02"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#1f183219-6b96-4656-bb53-ed82b105ef02"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0b92a597-03b9-44f5-849a-552f445bd1fb"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0b92a597-03b9-44f5-849a-552f445bd1fb"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0b92a597-03b9-44f5-849a-552f445bd1fb"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#0b92a597-03b9-44f5-849a-552f445bd1fb"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#072755b1-70ce-476e-b2fa-3ac5b8c1a382"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#072755b1-70ce-476e-b2fa-3ac5b8c1a382"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#072755b1-70ce-476e-b2fa-3ac5b8c1a382"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#072755b1-70ce-476e-b2fa-3ac5b8c1a382"
}
]
},
{
"id": "CVE-2026-33871",
"source": {
"name": "ghsa",
"url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven"
},
"ratings": [
{
"source": {
"name": "nvd"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"source": {
"name": "redhat"
},
"score": 7.5,
"severity": "high",
"method": "CVSSv31",
"vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"cwes": [
770
],
"description": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.",
"recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.1.132.Final, 4.2.11.Final",
"advisories": [
{
"url": "https://avd.aquasec.com/nvd/cve-2026-33871"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-33871"
},
{
"url": "https://github.com/netty/netty"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33871"
}
],
"published": "2026-03-27T20:16:34+00:00",
"updated": "2026-03-30T20:10:17+00:00",
"affects": [
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
"versions": [
{
"version": "4.1.130.Final",
"status": "affected"
}
]
},
{
"ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final",
"versions": [
{
"version": "4.1.130.Final",
"status": "affected"
}
]
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#52190b7c-095e-4f94-92a6-5257ede382c4"
},
{
"ref": "urn:cdx:9a3deb6b-f0a3-43bd-b8d8-1d1719aa36e0/1#52190b7c-095e-4f94-92a6-5257ede382c4"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:bfeea04f-7fd6-469a-80a4-28025280a94d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#5a90846a-47df-486c-b4d9-a7f1b5f15dce"
},
{
"ref": "urn:cdx:c605dc74-61ab-4db7-b4da-3ff1caa4ea54/1#5a90846a-47df-486c-b4d9-a7f1b5f15dce"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#b6e7d4cb-3341-45b3-b89c-95c1a69be4b7"
},
{
"ref": "urn:cdx:e4001d49-d0fe-48a9-b198-d662d4e9323f/1#b6e7d4cb-3341-45b3-b89c-95c1a69be4b7"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:73237031-27ef-4827-9715-b356c4a97d9f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:6caae490-6f7f-4715-889c-4dde7863dd03/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:b8fc2daa-6757-4b35-993d-a43931aa59b5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:dc31b0f1-fa89-4e9e-b806-e02b1208c787/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#ade07822-ebf2-4ef1-adbe-54bfff25ed83"
},
{
"ref": "urn:cdx:364f6faa-21b3-40ab-b996-97bae8da865e/1#ade07822-ebf2-4ef1-adbe-54bfff25ed83"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:c48a25f8-7070-4d22-b08f-546205c97855/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#80399e77-bdb1-4c33-90e3-fc88b645cc96"
},
{
"ref": "urn:cdx:afe5c908-9f30-4b12-b895-8147db431572/1#80399e77-bdb1-4c33-90e3-fc88b645cc96"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:2984b829-247d-4139-8b28-c481b3b39689/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#3657de05-be87-4294-b2f4-ab17a05921c5"
},
{
"ref": "urn:cdx:6c9152d4-0495-4ccd-a6a1-198e17215585/1#3657de05-be87-4294-b2f4-ab17a05921c5"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#23f3a443-cf49-4e97-bc16-ce8fcdd4d7f4"
},
{
"ref": "urn:cdx:2355f7ec-dddc-4709-b370-d1c29e14f109/1#23f3a443-cf49-4e97-bc16-ce8fcdd4d7f4"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#5682e8c7-315d-42c4-862f-83d0ce7f55ca"
},
{
"ref": "urn:cdx:acbfebc7-73c0-4373-8e55-5bf654666614/1#5682e8c7-315d-42c4-862f-83d0ce7f55ca"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#1f1f017a-82b4-4c65-84b9-baeaa41f0660"
},
{
"ref": "urn:cdx:95cc38b6-1ddc-402a-a37b-4f0b5056daf8/1#1f1f017a-82b4-4c65-84b9-baeaa41f0660"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:9cc9d564-bc66-4a14-b8c6-7eb40690eb9c/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#7d39ae6a-148c-4c71-ab63-e0dee4795fcb"
},
{
"ref": "urn:cdx:10549dd6-35fc-4f70-be3f-579dbdaee1c7/1#7d39ae6a-148c-4c71-ab63-e0dee4795fcb"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:75e52afa-aefa-450e-b084-6630fc48f572/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#2f6da455-e5f8-4559-aefa-da06a1212788"
},
{
"ref": "urn:cdx:0b100038-eef3-410a-9767-cd1353d8f34e/1#2f6da455-e5f8-4559-aefa-da06a1212788"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#07f916fc-90df-4dbc-8d1d-1c1416fd9880"
},
{
"ref": "urn:cdx:1e347770-8c13-48ff-9b5c-3f4a5252e8d9/1#07f916fc-90df-4dbc-8d1d-1c1416fd9880"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0e9bc044-652a-4a3c-85a8-771b21fe7ce2"
},
{
"ref": "urn:cdx:3fb38336-2e85-40fc-96b3-75fa5c64e697/1#0e9bc044-652a-4a3c-85a8-771b21fe7ce2"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#20c9f781-6322-49f4-ab22-428d86562efb"
},
{
"ref": "urn:cdx:6dc39f7c-7079-4fc5-99b5-f1e8f2e27556/1#20c9f781-6322-49f4-ab22-428d86562efb"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#2305ffad-fa85-4723-9b91-8def0caee236"
},
{
"ref": "urn:cdx:8bc5ac1b-95e5-46e1-bb17-8ff2186a918e/1#2305ffad-fa85-4723-9b91-8def0caee236"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#20932db5-f2f0-4e99-854d-a798b733a082"
},
{
"ref": "urn:cdx:4155a7ee-2407-4190-be48-8130554bfda0/1#20932db5-f2f0-4e99-854d-a798b733a082"
}
]
}
],
"component": []
}