{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fdc90096-3c63-48fc-aa8b-bbe534e00707", "version": 1, "metadata": { "timestamp": "2026-03-30T21:21:31+00:00", "tools": { "components": [ { "type": "application", "manufacturer": { "name": "Aqua Security Software Ltd." }, "group": "aquasecurity", "name": "trivy", "version": "0.69.3" } ] }, "component": { "bom-ref": "pkg:oci/cp-server-connect-base@sha256%3A4d029564d3ce87f100eddcd7997f79346ea9b071b13c98800c3116db64a73219?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-server-connect-base", "type": "container", "supplier": { "name": "Confluent" }, "name": "cp-server-connect-base", "version": "8.0.4", "purl": "pkg:oci/cp-server-connect-base@sha256%3A4d029564d3ce87f100eddcd7997f79346ea9b071b13c98800c3116db64a73219?arch=amd64&repository_url=519856050701.dkr.ecr.us-west-2.amazonaws.com%2Fdocker%2Fprod%2Fconfluentinc%2Fcp-server-connect-base", "properties": [ { "name": "aquasecurity:trivy:DiffID", "value": "sha256:0e5fc2ff88fe66038d243012d5af18cbf430de4da0cc93c8919174a009f28481" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:3800eaa64738b18f35ad0122c3365cfc73b74423f319d498e41d51ebb47996d9" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:3c2cd5cfceb5d380f6dc21a0815c149559d113f53bdcf3ac991fa2e4c4814c75" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:4b125ce836f36e94d43d08da24935037c7ff23012051802acd758e61562397b8" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:64fba2d85f4da8f867e5b5352dcb39d34f07b90c53ebecf01e3e3b2f80fd89ee" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:70ad6d05df652c50f5df491a13796e61784c846ed75c6a2d3899e3893e3fb381" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:9669f3c9a6ee2f25da7dba8347c845299148a45b92caa234aa315b96bf8e1891" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:a29da9f1b5c25072e5560158f9b865a5ce95ff26aa36246264f685fb867ab8e2" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:a6ab15a9e16c080ae006f45224acc99600e5167ad4b3bf38bf4f1c1417709a26" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:c16bec54db393671f3cc6af7e020d1561cb2cecaa2e0e6f5560ea63933ed8758" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:c75730b2422d26c1f26b2967e1f9f978e996bd5cbb5b0a036831f2a882adad86" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:c7d126a38ec29b4dfaa7477bb233e17cf1e9bfd0d3dd7af6201f8c5547ac3f50" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:c824bcf1601001ae7559b7efa99d49221068b2c3d1f95ac4bdedce71db4aa354" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:d14575d96c2d195811dcf725348e38e2505e39ab350d8c7a7586829d0bd1dad9" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:fce18dce5e8219c0266b003b0c608d65931ac634707962b9c246a377f419039b" }, { "name": "aquasecurity:trivy:ImageID", "value": "sha256:71184fdf35b4bd13358be16df9d01172d282e8f5c8e3eb508974cb6c57c5bd7a" }, { "name": "aquasecurity:trivy:Labels:architecture", "value": "x86_64" }, { "name": "aquasecurity:trivy:Labels:build-date", "value": "2026-02-17T16:42:34Z" }, { "name": "aquasecurity:trivy:Labels:com.redhat.component", "value": "ubi9-minimal-container" }, { "name": "aquasecurity:trivy:Labels:com.redhat.license_terms", "value": "https://www.redhat.com/en/about/red-hat-end-user-license-agreements#UBI" }, { "name": "aquasecurity:trivy:Labels:cpe", "value": "cpe:/a:redhat:enterprise_linux:9::appstream" }, { "name": "aquasecurity:trivy:Labels:description", "value": "Confluent platform server image." }, { "name": "aquasecurity:trivy:Labels:distribution-scope", "value": "public" }, { "name": "aquasecurity:trivy:Labels:io.buildah.version", "value": "1.42.2" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker", "value": "true" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker.build.number", "value": "03ea5585" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker.git.id", "value": "d88f6f1" }, { "name": "aquasecurity:trivy:Labels:io.confluent.docker.git.repo", "value": "confluentinc/kafka-images" }, { "name": "aquasecurity:trivy:Labels:io.k8s.description", "value": "The Universal Base Image Minimal is a stripped down image that uses microdnf as a package manager. This base image is freely redistributable, but Red Hat only supports Red Hat technologies through subscriptions for Red Hat products. This image is maintained by Red Hat and updated regularly." }, { "name": "aquasecurity:trivy:Labels:io.k8s.display-name", "value": "Red Hat Universal Base Image 9 Minimal" }, { "name": "aquasecurity:trivy:Labels:io.openshift.tags", "value": "minimal rhel9" }, { "name": "aquasecurity:trivy:Labels:maintainer", "value": "partner-support@confluent.io" }, { "name": "aquasecurity:trivy:Labels:name", "value": "cp-server-connect-base" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.created", "value": "2026-02-17T16:42:34Z" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", "value": "0ced2bbee24d5463d4530756a57f8db895246c48" }, { "name": "aquasecurity:trivy:Labels:release", "value": "8.0.4-35" }, { "name": "aquasecurity:trivy:Labels:summary", "value": "Confluent platform server connect base image." }, { "name": "aquasecurity:trivy:Labels:url", "value": "https://catalog.redhat.com/en/search?searchType=containers" }, { "name": "aquasecurity:trivy:Labels:vcs-ref", "value": "0ced2bbee24d5463d4530756a57f8db895246c48" }, { "name": "aquasecurity:trivy:Labels:vcs-type", "value": "git" }, { "name": "aquasecurity:trivy:Labels:vendor", "value": "Confluent" }, { "name": "aquasecurity:trivy:Labels:version", "value": "d88f6f1" }, { "name": "aquasecurity:trivy:Reference", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-server-connect-base:8.0.4-rc260224060337-latest-ubi9" }, { "name": "aquasecurity:trivy:RepoDigest", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-server-connect-base@sha256:4d029564d3ce87f100eddcd7997f79346ea9b071b13c98800c3116db64a73219" }, { "name": "aquasecurity:trivy:RepoTag", "value": "519856050701.dkr.ecr.us-west-2.amazonaws.com/docker/prod/confluentinc/cp-server-connect-base:8.0.4-rc260224060337-latest-ubi9" }, { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" }, { "name": "aquasecurity:trivy:Size", "value": "2779741184" } ] } }, "components": [], "dependencies": [], "vulnerabilities": [ { "id": "CVE-2005-2541", "ratings": [ { "source": { "name": "nvd" }, "score": 10, "severity": "high", "method": "CVSSv2", "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C" }, { "source": { "name": "redhat" }, "score": 7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2005-2541" }, { "url": "http://marc.info/?l=bugtraq&m=112327628230258&w=2" }, { "url": "https://access.redhat.com/security/cve/CVE-2005-2541" }, { "url": "https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2005-2541" } ], "published": "2005-08-10T04:00:00+00:00", "updated": "2025-04-03T01:03:51+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.34-9.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2021-31879", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 5.8, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 601 ], "description": "GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-31879" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-31879" }, { "url": "https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31879" }, { "url": "https://savannah.gnu.org/bugs/?56909" }, { "url": "https://security.netapp.com/advisory/ntap-20210618-0002/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-31879" } ], "published": "2021-04-29T05:15:08+00:00", "updated": "2024-11-21T06:06:25+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "1.21.1-8.el9_4", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2021-3572", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 3.5, "severity": "info", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:S/C:N/I:P/A:N" }, { "source": { "name": "nvd" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 20 ], "description": "A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2021-3572" }, { "url": "https://access.redhat.com/errata/RHSA-2021:3254" }, { "url": "https://access.redhat.com/security/cve/CVE-2021-3572" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1772014" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928707" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928904" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1935913" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1941534" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1955615" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957458" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1962856" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1968074" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18874" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27619" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28493" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20095" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28957" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29921" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33503" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3426" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3572" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42771" }, { "url": "https://errata.rockylinux.org/RLSA-2021:4162" }, { "url": "https://github.com/advisories/GHSA-5xp3-jfq3-5q8x" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2021-437.yaml" }, { "url": "https://github.com/pypa/pip" }, { "url": "https://github.com/pypa/pip/commit/e46bdda9711392fec0c45c1175bae6db847cb30b" }, { "url": "https://github.com/pypa/pip/issues/10042" }, { "url": "https://github.com/pypa/pip/issues/10042#issuecomment-857452480" }, { "url": "https://github.com/pypa/pip/pull/9827" }, { "url": "https://github.com/skazi0/CVE-2021-3572/blob/master/CVE-2021-3572-v9.0.1.patch" }, { "url": "https://linux.oracle.com/cve/CVE-2021-3572.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2023-12349.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3572" }, { "url": "https://packetstormsecurity.com/files/162712/USN-4961-1.txt" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-4961-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2021-3572" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html" } ], "published": "2021-11-10T18:15:09+00:00", "updated": "2024-11-21T06:21:52+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ] }, { "id": "CVE-2022-27943", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.3, "severity": "medium", "method": "CVSSv2", "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 674 ], "description": "libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-27943" }, { "url": "https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79" }, { "url": "https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead" }, { "url": "https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27943" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=28995" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-27943" } ], "published": "2022-03-26T13:15:07+00:00", "updated": "2024-11-21T06:56:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "11.5.0-11.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "11.5.0-11.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "11.5.0-11.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libgcc@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libgomp@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libstdc%2B%2B@11.5.0-11.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable." } }, { "id": "CVE-2022-3219", "ratings": [ { "source": { "name": "nvd" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 787 ], "description": "GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-3219" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-3219" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2127010" }, { "url": "https://dev.gnupg.org/D556" }, { "url": "https://dev.gnupg.org/T5993" }, { "url": "https://marc.info/?l=oss-security&m=165696590211434&w=4" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3219" }, { "url": "https://security.netapp.com/advisory/ntap-20230324-0001/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-3219" } ], "published": "2023-02-23T20:15:12+00:00", "updated": "2025-03-12T21:15:38+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.3.3-5.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2022-41409", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "url": "https://access.redhat.com/security/cve/CVE-2022-41409" }, { "url": "https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35" }, { "url": "https://github.com/PCRE2Project/pcre2/issues/141" }, { "url": "https://github.com/advisories/GHSA-4qfx-v7wh-3q4j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41409" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2022-41409" } ], "published": "2023-07-18T14:15:12+00:00", "updated": "2024-11-21T07:23:10+00:00", "affects": [ { "ref": "pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "10.40-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/pcre2-syntax@10.40-6.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/pcre2@10.40-6.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable." } }, { "id": "CVE-2023-30571", "ratings": [ { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H" } ], "cwes": [ 362 ], "description": "Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask 0 setting. Such a race condition could lead to implicit directory creation with permissions 0777 (without the sticky bit), which means that any low-privileged local user can delete and rename files inside those directories.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-30571" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-30571" }, { "url": "https://access.redhat.com/solutions/7033331" }, { "url": "https://github.com/libarchive/libarchive/issues/1876" }, { "url": "https://groups.google.com/g/libarchive-announce" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30571" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-30571" } ], "published": "2023-05-29T20:15:09+00:00", "updated": "2025-01-14T17:15:11+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2023-32636", "ratings": [ { "source": { "name": "alma" }, "severity": "low" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400, 502 ], "description": "A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validation added to resolve CVE-2023-29499. The offset table validation may be very slow. This bug does not affect any released version of glib but does affect glib distributors who followed the guidance of glib developers to backport the initial fix for CVE-2023-29499.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-32636" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2528" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-32636" }, { "url": "https://bugzilla.redhat.com/2211827" }, { "url": "https://bugzilla.redhat.com/2211828" }, { "url": "https://bugzilla.redhat.com/2211829" }, { "url": "https://bugzilla.redhat.com/2211833" }, { "url": "https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835" }, { "url": "https://errata.almalinux.org/9/ALSA-2024-2528.html" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/2841" }, { "url": "https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835" }, { "url": "https://linux.oracle.com/cve/CVE-2023-32636.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2024-2528.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32636" }, { "url": "https://security.netapp.com/advisory/ntap-20231110-0002/" }, { "url": "https://ubuntu.com/security/notices/USN-6165-1" }, { "url": "https://ubuntu.com/security/notices/USN-6165-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-32636" } ], "published": "2023-09-14T20:15:09+00:00", "updated": "2024-11-21T08:03:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable." } }, { "id": "CVE-2023-39804", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "description": "In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-39804" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-39804" }, { "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1058079" }, { "url": "https://git.savannah.gnu.org/cgit/tar.git/commit/?id=a339f05cd269013fa133d2f148d73f6f7d4247e4" }, { "url": "https://git.savannah.gnu.org/cgit/tar.git/tree/src/xheader.c?h=release_1_34#n1723" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/03/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39804" }, { "url": "https://ubuntu.com/security/notices/USN-6543-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-39804" } ], "published": "2024-03-27T04:15:08+00:00", "updated": "2025-11-04T19:15:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.34-9.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2023-4156", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-4156" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-4156" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930" }, { "url": "https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212" }, { "url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00000.html" }, { "url": "https://mail.gnu.org/archive/html/bug-gawk/2022-08/msg00023.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4156" }, { "url": "https://ubuntu.com/security/notices/USN-6373-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-4156" } ], "published": "2023-09-25T18:15:11+00:00", "updated": "2024-11-21T08:34:30+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "5.1.0-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gawk@5.1.0-6.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2023-45322", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in tree.c. NOTE: the vendor's position is \"I don't think these issues are critical enough to warrant a CVE ID ... because an attacker typically can't control when memory allocations fail.\"", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-45322" }, { "url": "http://www.openwall.com/lists/oss-security/2023/10/06/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-45322" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/344" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/583" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45322" } ], "published": "2023-10-06T22:15:11+00:00", "updated": "2025-11-03T21:16:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2023-45803", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 200 ], "description": "urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required by HTTP RFCs. Although this behavior is not specified in the section for redirects, it can be inferred by piecing together information from different sections and we have observed the behavior in other major HTTP client implementations like curl and web browsers. Because the vulnerability requires a previously trusted service to become compromised in order to have an impact on confidentiality we believe the exploitability of this vulnerability is low. Additionally, many users aren't putting sensitive data in HTTP request bodies, if this is the case then this vulnerability isn't exploitable. Both of the following conditions must be true to be affected by this vulnerability: 1. Using urllib3 and submitting sensitive information in the HTTP request body (such as form data or JSON) and 2. The origin service is compromised and starts redirecting using 301, 302, or 303 to a malicious peer or the redirected-to service becomes compromised. This issue has been addressed in versions 1.26.18 and 2.0.7 and users are advised to update to resolve this issue. Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False` and disable automatic redirects with `redirects=False` and handle 301, 302, and 303 redirects manually by stripping the HTTP request body.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-45803" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2132" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-45803" }, { "url": "https://bugzilla.redhat.com/2246840" }, { "url": "https://bugzilla.redhat.com/2257028" }, { "url": "https://bugzilla.redhat.com/2257854" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2246840" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45803" }, { "url": "https://errata.almalinux.org/9/ALSA-2024-2132.html" }, { "url": "https://errata.rockylinux.org/RLSA-2024:11238" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2023-212.yaml" }, { "url": "https://github.com/urllib3/urllib3" }, { "url": "https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3" }, { "url": "https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9" }, { "url": "https://github.com/urllib3/urllib3/commit/b594c5ceaca38e1ac215f916538fb128e3526a36" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/1.26.18" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/2.0.7" }, { "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-g4mx-q9vg-27p4" }, { "url": "https://linux.oracle.com/cve/CVE-2023-45803.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2024-2988.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00020.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4R2Y5XK3WALSR3FNAGN7JBYV2B343ZKB/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5F5CUBAN5XMEBVBZPHFITBLMJV5FIJJ5/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PPDPLM6UUMN55ESPQWJFLLIZY4ZKCNRX/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45803" }, { "url": "https://ubuntu.com/security/notices/USN-6473-1" }, { "url": "https://ubuntu.com/security/notices/USN-6473-2" }, { "url": "https://ubuntu.com/security/notices/USN-7762-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-45803" }, { "url": "https://www.rfc-editor.org/rfc/rfc9110.html#name-get" } ], "published": "2023-10-17T20:15:10+00:00", "updated": "2025-11-03T22:16:28+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ] }, { "id": "CVE-2023-50495", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "description": "NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-50495" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html" }, { "url": "https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-50495" }, { "url": "https://security.netapp.com/advisory/ntap-20240119-0008/" }, { "url": "https://ubuntu.com/security/notices/USN-6684-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-50495" } ], "published": "2023-12-12T15:15:07+00:00", "updated": "2025-11-04T19:16:14+00:00", "affects": [ { "ref": "pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "6.2-12.20210508.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/ncurses-base@6.2-12.20210508.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/ncurses-libs@6.2-12.20210508.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable." } }, { "id": "CVE-2023-5752", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 77 ], "description": "When installing a package from a Mercurial VCS URL (ie \"pip install \nhg+...\") with pip prior to v23.3, the specified Mercurial revision could\n be used to inject arbitrary configuration options to the \"hg clone\" \ncall (ie \"--config\"). Controlling the Mercurial configuration can modify\n how and which repository is installed. This vulnerability does not \naffect users who aren't installing from Mercurial.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2023-5752" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-5752" }, { "url": "https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2023-228.yaml" }, { "url": "https://github.com/pypa/pip" }, { "url": "https://github.com/pypa/pip/commit/389cb799d0da9a840749fcd14878928467ed49b4" }, { "url": "https://github.com/pypa/pip/pull/12306" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ/" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5752" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2023-5752" } ], "published": "2023-10-25T18:17:44+00:00", "updated": "2025-11-03T18:15:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": "Mercurial is not available in RHEL 8 and 9, so the vulnerability cannot be exploited. Without mercurial installed (the hg command), pip cannot clone and install from hg+http[s] URLs." } }, { "id": "CVE-2024-0232", "ratings": [ { "source": { "name": "bitnami" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 416 ], "description": "A heap use-after-free issue has been identified in SQLite in the jsonParseAddNodeArray() function in sqlite3.c. This flaw allows a local attacker to leverage a victim to pass specially crafted malicious input to the application, potentially causing a crash and leading to a denial of service.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-0232" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243754" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QDCMYQ3J45NHQ4EJREM3BJNNKB5BK4Y7/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0232" }, { "url": "https://security.netapp.com/advisory/ntap-20240315-0007/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-0232" } ], "published": "2024-01-16T14:15:48+00:00", "updated": "2024-11-21T08:46:06+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.34.1-9.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2024-10524", "ratings": [ { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L" } ], "cwes": [ 918 ], "description": "Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-10524" }, { "url": "http://www.openwall.com/lists/oss-security/2024/11/18/6" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-10524" }, { "url": "https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778" }, { "url": "https://jfrog.com/blog/cve-2024-10524-wget-zero-day-vulnerability/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10524" }, { "url": "https://seclists.org/oss-sec/2024/q4/107" }, { "url": "https://security.netapp.com/advisory/ntap-20250321-0007/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-10524" } ], "published": "2024-11-19T15:15:06+00:00", "updated": "2025-03-21T18:15:32+00:00", "affects": [ { "ref": "pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "1.21.1-8.el9_4", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/wget@1.21.1-8.el9_4?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2024-11053", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "description": "When asked to both use a `.netrc` file for credentials and to follow HTTP\nredirects, curl could leak the password used for the first host to the\nfollowed-to host under certain circumstances.\n\nThis flaw only manifests itself if the netrc file has an entry that matches\nthe redirect target hostname but the entry either omits just the password or\nomits both login and password.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-11053" }, { "url": "http://www.openwall.com/lists/oss-security/2024/12/11/1" }, { "url": "https://access.redhat.com/errata/RHSA-2025:1671" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-11053" }, { "url": "https://bugzilla.redhat.com/2294581" }, { "url": "https://bugzilla.redhat.com/2294676" }, { "url": "https://bugzilla.redhat.com/2301888" }, { "url": "https://bugzilla.redhat.com/2318857" }, { "url": "https://bugzilla.redhat.com/2318858" }, { "url": "https://bugzilla.redhat.com/2318870" }, { "url": "https://bugzilla.redhat.com/2318873" }, { "url": "https://bugzilla.redhat.com/2318874" }, { "url": "https://bugzilla.redhat.com/2318876" }, { "url": "https://bugzilla.redhat.com/2318882" }, { "url": "https://bugzilla.redhat.com/2318883" }, { "url": "https://bugzilla.redhat.com/2318884" }, { "url": "https://bugzilla.redhat.com/2318885" }, { "url": "https://bugzilla.redhat.com/2318886" }, { "url": "https://bugzilla.redhat.com/2318897" }, { "url": "https://bugzilla.redhat.com/2318900" }, { "url": "https://bugzilla.redhat.com/2318905" }, { "url": "https://bugzilla.redhat.com/2318914" }, { "url": "https://bugzilla.redhat.com/2318922" }, { "url": "https://bugzilla.redhat.com/2318923" }, { "url": "https://bugzilla.redhat.com/2318925" }, { "url": "https://bugzilla.redhat.com/2318926" }, { "url": "https://bugzilla.redhat.com/2318927" }, { "url": "https://bugzilla.redhat.com/2331191" }, { "url": "https://bugzilla.redhat.com/2339218" }, { "url": "https://bugzilla.redhat.com/2339220" }, { "url": "https://bugzilla.redhat.com/2339221" }, { "url": "https://bugzilla.redhat.com/2339226" }, { "url": "https://bugzilla.redhat.com/2339231" }, { "url": "https://bugzilla.redhat.com/2339236" }, { "url": "https://bugzilla.redhat.com/2339238" }, { "url": "https://bugzilla.redhat.com/2339243" }, { "url": "https://bugzilla.redhat.com/2339247" }, { "url": "https://bugzilla.redhat.com/2339252" }, { "url": "https://bugzilla.redhat.com/2339259" }, { "url": "https://bugzilla.redhat.com/2339266" }, { "url": "https://bugzilla.redhat.com/2339270" }, { "url": "https://bugzilla.redhat.com/2339271" }, { "url": "https://bugzilla.redhat.com/2339275" }, { "url": "https://bugzilla.redhat.com/2339277" }, { "url": "https://bugzilla.redhat.com/2339281" }, { "url": "https://bugzilla.redhat.com/2339284" }, { "url": "https://bugzilla.redhat.com/2339291" }, { "url": "https://bugzilla.redhat.com/2339293" }, { "url": "https://bugzilla.redhat.com/2339295" }, { "url": "https://bugzilla.redhat.com/2339299" }, { "url": "https://bugzilla.redhat.com/2339300" }, { "url": "https://bugzilla.redhat.com/2339304" }, { "url": "https://bugzilla.redhat.com/2339305" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305" }, { "url": "https://curl.se/docs/CVE-2024-11053.html" }, { "url": "https://curl.se/docs/CVE-2024-11053.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-1671.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:1671" }, { "url": "https://hackerone.com/reports/2829063" }, { "url": "https://linux.oracle.com/cve/CVE-2024-11053.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-1673.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11053" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0012/" }, { "url": "https://security.netapp.com/advisory/ntap-20250131-0003/" }, { "url": "https://security.netapp.com/advisory/ntap-20250131-0004/" }, { "url": "https://ubuntu.com/security/notices/USN-7162-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-11053" }, { "url": "https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL" } ], "published": "2024-12-11T08:15:05+00:00", "updated": "2025-11-03T21:16:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2024-13176", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 385 ], "description": "Issue summary: A timing side-channel which could potentially allow recovering\nthe private key exists in the ECDSA signature computation.\n\nImpact summary: A timing side-channel in ECDSA signature computations\ncould allow recovering the private key by an attacker. However, measuring\nthe timing would require either local access to the signing application or\na very fast network connection with low latency.\n\nThere is a timing signal of around 300 nanoseconds when the top word of\nthe inverted ECDSA nonce value is zero. This can happen with significant\nprobability only for some of the supported elliptic curves. In particular\nthe NIST P-521 curve is affected. To be able to measure this leak, the attacker\nprocess must either be located in the same physical computer or must\nhave a very fast network connection with low latency. For that reason\nthe severity of this vulnerability is Low.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are affected by this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "url": "http://www.openwall.com/lists/oss-security/2025/01/20/2" }, { "url": "https://access.redhat.com/errata/RHSA-2025:16046" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-13176" }, { "url": "https://bugzilla.redhat.com/2359885" }, { "url": "https://bugzilla.redhat.com/2359888" }, { "url": "https://bugzilla.redhat.com/2359892" }, { "url": "https://bugzilla.redhat.com/2359894" }, { "url": "https://bugzilla.redhat.com/2359895" }, { "url": "https://bugzilla.redhat.com/2359899" }, { "url": "https://bugzilla.redhat.com/2359900" }, { "url": "https://bugzilla.redhat.com/2359902" }, { "url": "https://bugzilla.redhat.com/2359903" }, { "url": "https://bugzilla.redhat.com/2359911" }, { "url": "https://bugzilla.redhat.com/2359918" }, { "url": "https://bugzilla.redhat.com/2359920" }, { "url": "https://bugzilla.redhat.com/2359924" }, { "url": "https://bugzilla.redhat.com/2359928" }, { "url": "https://bugzilla.redhat.com/2359930" }, { "url": "https://bugzilla.redhat.com/2359932" }, { "url": "https://bugzilla.redhat.com/2359934" }, { "url": "https://bugzilla.redhat.com/2359938" }, { "url": "https://bugzilla.redhat.com/2359940" }, { "url": "https://bugzilla.redhat.com/2359943" }, { "url": "https://bugzilla.redhat.com/2359944" }, { "url": "https://bugzilla.redhat.com/2359945" }, { "url": "https://bugzilla.redhat.com/2359947" }, { "url": "https://bugzilla.redhat.com/2359950" }, { "url": "https://bugzilla.redhat.com/2359963" }, { "url": "https://bugzilla.redhat.com/2359964" }, { "url": "https://bugzilla.redhat.com/2359972" }, { "url": "https://bugzilla.redhat.com/2370920" }, { "url": "https://bugzilla.redhat.com/2380264" }, { "url": "https://bugzilla.redhat.com/2380273" }, { "url": "https://bugzilla.redhat.com/2380274" }, { "url": "https://bugzilla.redhat.com/2380278" }, { "url": "https://bugzilla.redhat.com/2380280" }, { "url": "https://bugzilla.redhat.com/2380283" }, { "url": "https://bugzilla.redhat.com/2380284" }, { "url": "https://bugzilla.redhat.com/2380290" }, { "url": "https://bugzilla.redhat.com/2380291" }, { "url": "https://bugzilla.redhat.com/2380295" }, { "url": "https://bugzilla.redhat.com/2380298" }, { "url": "https://bugzilla.redhat.com/2380306" }, { "url": "https://bugzilla.redhat.com/2380308" }, { "url": "https://bugzilla.redhat.com/2380309" }, { "url": "https://bugzilla.redhat.com/2380310" }, { "url": "https://bugzilla.redhat.com/2380312" }, { "url": "https://bugzilla.redhat.com/2380313" }, { "url": "https://bugzilla.redhat.com/2380320" }, { "url": "https://bugzilla.redhat.com/2380321" }, { "url": "https://bugzilla.redhat.com/2380322" }, { "url": "https://bugzilla.redhat.com/2380326" }, { "url": "https://bugzilla.redhat.com/2380327" }, { "url": "https://bugzilla.redhat.com/2380334" }, { "url": "https://bugzilla.redhat.com/2380335" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2338999" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359892" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359894" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359895" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359899" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359902" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359903" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359911" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359918" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359920" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359924" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359928" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359930" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359932" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359934" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359938" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359940" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359943" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359944" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359945" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359947" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359950" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359963" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359964" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359972" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370920" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380264" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380273" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380274" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380278" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380280" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380283" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380290" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380298" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380306" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380308" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380309" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380310" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380312" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380313" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380320" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380321" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380322" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380326" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380327" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380334" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2380335" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-16046.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:15699" }, { "url": "https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844" }, { "url": "https://github.com/openssl/openssl/commit/2af62e74fb59bc469506bc37eb2990ea408d9467" }, { "url": "https://github.com/openssl/openssl/commit/392dcb336405a0c94486aa6655057f59fd3a0902" }, { "url": "https://github.com/openssl/openssl/commit/4b1cb94a734a7d4ec363ac0a215a25c181e11f65" }, { "url": "https://github.com/openssl/openssl/commit/77c608f4c8857e63e98e66444e2e761c9627916f" }, { "url": "https://github.openssl.org/openssl/extended-releases/commit/0d5fd1ab987f7571e2c955d8d8b638fc0fb54ded" }, { "url": "https://github.openssl.org/openssl/extended-releases/commit/a2639000db19878d5d89586ae7b725080592ae86" }, { "url": "https://linux.oracle.com/cve/CVE-2024-13176.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-16046.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13176" }, { "url": "https://openssl-library.org/news/secadv/20250120.txt" }, { "url": "https://security.netapp.com/advisory/ntap-20250124-0005/" }, { "url": "https://security.netapp.com/advisory/ntap-20250418-0010/" }, { "url": "https://security.netapp.com/advisory/ntap-20250502-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-7264-1" }, { "url": "https://ubuntu.com/security/notices/USN-7278-1" }, { "url": "https://ubuntu.com/security/notices/USN-7894-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-13176" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2025.html#AppendixMSQL" } ], "published": "2025-01-20T14:15:26+00:00", "updated": "2025-11-03T20:16:08+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" } ] }, { "id": "CVE-2024-25260", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-25260" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-25260" }, { "url": "https://github.com/schsiung/fuzzer_issues/issues/1" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25260" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=31058" }, { "url": "https://sourceware.org/elfutils/" }, { "url": "https://ubuntu.com/security/notices/USN-7369-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-25260" } ], "published": "2024-02-20T18:15:52+00:00", "updated": "2025-04-25T20:42:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable." } }, { "id": "CVE-2024-29040", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 502 ], "description": "This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure `TPMS_ATTEST`. For the field `TPM2_GENERATED magic` of this structure any number can be used in the JSON structure. The verifier can receive a state which does not represent the actual, possibly malicious state of the device under test. The malicious device might get access to data it shouldn't, or can use services it shouldn't be able to. This \nissue has been patched in version 4.1.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-29040" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-29040" }, { "url": "https://github.com/tpm2-software/tpm2-tss/commit/710cd0b6adf3a063f34a8e92da46df7a107d9a99" }, { "url": "https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0" }, { "url": "https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-837m-jw3m-h9p6" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFR7SVEWCOXORHPCLLGXEMHFMIGG2MFE/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GI4JFEZBKQQUPJ4RWK6IHEWXAFCEJDPI/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29040" }, { "url": "https://ubuntu.com/security/notices/USN-6796-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-29040" } ], "published": "2024-06-28T21:15:02+00:00", "updated": "2025-11-04T18:16:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.2.3-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/tpm2-tss@3.2.3-1.el9?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2024-34459", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 122 ], "description": "An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-34459" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-34459" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.8" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.7" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5HVUXKYTBWT3G5DEEQX62STJQBY367NL/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/INKSSLW5VMZIXHRPZBAW4TJUX5SQKARG/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VRDJCNQP32LV56KESUQ5SNZKAJWSZZRI/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459" }, { "url": "https://ubuntu.com/security/notices/USN-7240-1" }, { "url": "https://ubuntu.com/security/notices/USN-7302-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-34459" } ], "published": "2024-05-14T15:39:11+00:00", "updated": "2025-11-04T22:16:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform\u00a0 is not linked against the vulnerable system library. That assures that the vulnerable code path in the affected library is not reachable." } }, { "id": "CVE-2024-41996", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 295 ], "description": "Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-41996" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-41996" }, { "url": "https://dheatattack.gitlab.io/details/" }, { "url": "https://dheatattack.gitlab.io/faq/" }, { "url": "https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1" }, { "url": "https://github.com/openssl/openssl/issues/17374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41996" }, { "url": "https://openssl-library.org/post/2022-10-21-tls-groups-configuration/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-41996" } ], "published": "2024-08-26T06:15:04+00:00", "updated": "2024-08-26T16:35:11+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Java Runtime that executes Confluent Platform does not invoke any binaries present in the container. That assures that the vulnerable code path in the affected application is not reachable." } }, { "id": "CVE-2024-7264", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an\nASN.1 Generalized Time field. If given an syntactically incorrect field, the\nparser might end up using -1 for the length of the *time fraction*, leading to\na `strlen()` getting performed on a pointer to a heap buffer area that is not\n(purposely) null terminated.\n\nThis flaw most likely leads to a crash, but can also lead to heap contents\ngetting returned to the application when\n[CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-7264" }, { "url": "http://www.openwall.com/lists/oss-security/2024/07/31/1" }, { "url": "https://access.redhat.com/errata/RHSA-2025:1671" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-7264" }, { "url": "https://bugzilla.redhat.com/2294581" }, { "url": "https://bugzilla.redhat.com/2294676" }, { "url": "https://bugzilla.redhat.com/2301888" }, { "url": "https://bugzilla.redhat.com/2318857" }, { "url": "https://bugzilla.redhat.com/2318858" }, { "url": "https://bugzilla.redhat.com/2318870" }, { "url": "https://bugzilla.redhat.com/2318873" }, { "url": "https://bugzilla.redhat.com/2318874" }, { "url": "https://bugzilla.redhat.com/2318876" }, { "url": "https://bugzilla.redhat.com/2318882" }, { "url": "https://bugzilla.redhat.com/2318883" }, { "url": "https://bugzilla.redhat.com/2318884" }, { "url": "https://bugzilla.redhat.com/2318885" }, { "url": "https://bugzilla.redhat.com/2318886" }, { "url": "https://bugzilla.redhat.com/2318897" }, { "url": "https://bugzilla.redhat.com/2318900" }, { "url": "https://bugzilla.redhat.com/2318905" }, { "url": "https://bugzilla.redhat.com/2318914" }, { "url": "https://bugzilla.redhat.com/2318922" }, { "url": "https://bugzilla.redhat.com/2318923" }, { "url": "https://bugzilla.redhat.com/2318925" }, { "url": "https://bugzilla.redhat.com/2318926" }, { "url": "https://bugzilla.redhat.com/2318927" }, { "url": "https://bugzilla.redhat.com/2331191" }, { "url": "https://bugzilla.redhat.com/2339218" }, { "url": "https://bugzilla.redhat.com/2339220" }, { "url": "https://bugzilla.redhat.com/2339221" }, { "url": "https://bugzilla.redhat.com/2339226" }, { "url": "https://bugzilla.redhat.com/2339231" }, { "url": "https://bugzilla.redhat.com/2339236" }, { "url": "https://bugzilla.redhat.com/2339238" }, { "url": "https://bugzilla.redhat.com/2339243" }, { "url": "https://bugzilla.redhat.com/2339247" }, { "url": "https://bugzilla.redhat.com/2339252" }, { "url": "https://bugzilla.redhat.com/2339259" }, { "url": "https://bugzilla.redhat.com/2339266" }, { "url": "https://bugzilla.redhat.com/2339270" }, { "url": "https://bugzilla.redhat.com/2339271" }, { "url": "https://bugzilla.redhat.com/2339275" }, { "url": "https://bugzilla.redhat.com/2339277" }, { "url": "https://bugzilla.redhat.com/2339281" }, { "url": "https://bugzilla.redhat.com/2339284" }, { "url": "https://bugzilla.redhat.com/2339291" }, { "url": "https://bugzilla.redhat.com/2339293" }, { "url": "https://bugzilla.redhat.com/2339295" }, { "url": "https://bugzilla.redhat.com/2339299" }, { "url": "https://bugzilla.redhat.com/2339300" }, { "url": "https://bugzilla.redhat.com/2339304" }, { "url": "https://bugzilla.redhat.com/2339305" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294581" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294676" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2301888" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318857" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318858" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318870" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318873" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318874" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318876" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318882" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318883" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318884" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318885" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318886" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318897" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318900" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318905" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318914" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318922" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318923" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318925" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318926" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2318927" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331191" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339218" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339220" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339221" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339226" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339231" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339236" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339238" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339243" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339247" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339252" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339259" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339266" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339270" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339271" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339275" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339277" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339281" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339284" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339291" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339293" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339295" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339299" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339300" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339304" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2339305" }, { "url": "https://curl.se/docs/CVE-2024-7264.html" }, { "url": "https://curl.se/docs/CVE-2024-7264.json" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11053" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21193" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21194" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21196" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21197" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21198" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21199" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21201" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21203" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21212" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21213" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21218" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21219" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21230" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21231" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21236" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21237" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21238" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21239" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21241" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21247" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37371" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5535" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7264" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21491" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21494" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21497" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21500" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21501" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21503" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21504" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21505" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21518" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21519" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21520" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21521" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21522" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21523" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21525" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21529" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21531" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21534" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21536" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21540" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21543" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21546" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21555" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21559" }, { "url": "https://errata.almalinux.org/9/ALSA-2025-1671.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:1671" }, { "url": "https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519" }, { "url": "https://hackerone.com/reports/2629968" }, { "url": "https://linux.oracle.com/cve/CVE-2024-7264.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-1673.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7264" }, { "url": "https://security.netapp.com/advisory/ntap-20240828-0008/" }, { "url": "https://security.netapp.com/advisory/ntap-20241025-0006/" }, { "url": "https://security.netapp.com/advisory/ntap-20241025-0010/" }, { "url": "https://ubuntu.com/security/notices/USN-6944-1" }, { "url": "https://ubuntu.com/security/notices/USN-6944-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-7264" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2024.html#AppendixMSQL" } ], "published": "2024-07-31T08:15:02+00:00", "updated": "2025-11-03T23:17:31+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2024-9681", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 697 ], "description": "When curl is asked to use HSTS, the expiry time for a subdomain might\noverwrite a parent domain's cache entry, making it end sooner or later than\notherwise intended.\n\nThis affects curl using applications that enable HSTS and use URLs with the\ninsecure `HTTP://` scheme and perform transfers with hosts like\n`x.example.com` as well as `example.com` where the first host is a subdomain\nof the second host.\n\n(The HSTS cache either needs to have been populated manually or there needs to\nhave been previous HTTPS accesses done as the cache needs to have entries for\nthe domains involved to trigger this problem.)\n\nWhen `x.example.com` responds with `Strict-Transport-Security:` headers, this\nbug can make the subdomain's expiry timeout *bleed over* and get set for the\nparent domain `example.com` in curl's HSTS cache.\n\nThe result of a triggered bug is that HTTP accesses to `example.com` get\nconverted to HTTPS for a different period of time than what was asked for by\nthe origin server. If `example.com` for example stops supporting HTTPS at its\nexpiry time, curl might then fail to access `http://example.com` until the\n(wrongly set) timeout expires. This bug can also expire the parent's entry\n*earlier*, thus making curl inadvertently switch back to insecure HTTP earlier\nthan otherwise intended.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2024-9681" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "url": "http://www.openwall.com/lists/oss-security/2024/11/06/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2024-9681" }, { "url": "https://curl.se/docs/CVE-2024-9681.html" }, { "url": "https://curl.se/docs/CVE-2024-9681.json" }, { "url": "https://hackerone.com/reports/2764830" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9681" }, { "url": "https://security.netapp.com/advisory/ntap-20241213-0006/" }, { "url": "https://ubuntu.com/security/notices/USN-7104-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2024-9681" } ], "published": "2024-11-06T08:15:03+00:00", "updated": "2025-11-03T21:18:48+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-11468", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-11468" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-11468" }, { "url": "https://github.com/python/cpython/commit/003b8315669b9f08b1010a49071f73f15f818094" }, { "url": "https://github.com/python/cpython/commit/17d1490aa97bd6b98a42b1a9b324ead84e7fd8a2" }, { "url": "https://github.com/python/cpython/commit/61614a5e5056e4f61ced65008d4576f3df34acb6" }, { "url": "https://github.com/python/cpython/commit/a76e4cd62dd68e7cbe86e37e6ed988495a646b66" }, { "url": "https://github.com/python/cpython/commit/e9970f077240c7c670e8a6fc6662f2b30d3b6ad0" }, { "url": "https://github.com/python/cpython/commit/f738386838021c762efea6c9802c82de65e87796" }, { "url": "https://github.com/python/cpython/issues/143935" }, { "url": "https://github.com/python/cpython/pull/143936" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/FELSEOLBI2QR6YLG6Q7VYF7FWSGQTKLI/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11468" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-11468" } ], "published": "2026-01-20T22:15:50+00:00", "updated": "2026-03-03T15:16:13+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-11961", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 1.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 122, 126 ], "description": "pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-11961" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-11961" }, { "url": "https://github.com/the-tcpdump-group/libpcap/commit/b2d2f9a9a0581c40780bde509f7cc715920f1c02" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11961" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-11961" } ], "published": "2025-12-31T01:15:54+00:00", "updated": "2025-12-31T20:42:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14", "versions": [ { "version": "14:1.10.0-4.el9", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpcap@1.10.0-4.el9?arch=x86_64&distro=redhat-9.7&epoch=14" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-12781", "ratings": [ { "source": { "name": "nvd" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 704 ], "description": "When passing data to the b64decode(), standard_b64decode(), and urlsafe_b64decode() functions in the \"base64\" module the characters \"+/\" will always be accepted, regardless of the value of \"altchars\" parameter, typically used to establish an \"alternative base64 alphabet\" such as the URL safe alphabet. This behavior matches what is recommended in earlier base64 RFCs, but newer RFCs now recommend either dropping characters outside the specified base64 alphabet or raising an error. The old behavior has the possibility of causing data integrity issues.\n\n\n\n\nThis behavior can only be insecure if your application uses an alternate base64 alphabet (without \"+/\"). If your application does not use the \"altchars\" parameter or the urlsafe_b64decode() function, then your application does not use an alternative base64 alphabet.\n\n\n\n\nThe attached patches DOES NOT make the base64-decode behavior raise an error, as this would be a change in behavior and break existing programs. Instead, the patch deprecates the behavior which will be replaced with the newly recommended behavior in a future version of Python.\u00a0Users are recommended to mitigate by verifying user-controlled inputs match the base64 \nalphabet they are expecting or verify that their application would not be \naffected if the b64decode() functions accepted \"+\" or \"/\" outside of altchars.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-12781" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-12781" }, { "url": "https://github.com/python/cpython/commit/13360efd385d1a7d0659beba03787ea3d063ef9b" }, { "url": "https://github.com/python/cpython/commit/1be80bec7960f5ccd059e75f3dfbd45fca302947" }, { "url": "https://github.com/python/cpython/commit/9060b4abbe475591b6230b23c2afefeff26fcca5" }, { "url": "https://github.com/python/cpython/commit/e95e783dff443b68e8179fdb57737025bf02ba76" }, { "url": "https://github.com/python/cpython/commit/fd17ee026fa9b67f6288cbafe374a3e479fe03a5" }, { "url": "https://github.com/python/cpython/issues/125346" }, { "url": "https://github.com/python/cpython/pull/141128" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/KRI7GC6S27YV5NJ4FPDALS2WI5ENAFJ6/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12781" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-12781" } ], "published": "2026-01-21T20:16:04+00:00", "updated": "2026-02-02T17:25:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-13151", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-13151" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/08/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-13151" }, { "url": "https://gitlab.com/gnutls/libtasn1" }, { "url": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151" }, { "url": "https://ubuntu.com/security/notices/USN-7954-1" }, { "url": "https://ubuntu.com/security/notices/USN-7954-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-13151" }, { "url": "https://www.kb.cert.org/vuls/id/271649" } ], "published": "2026-01-07T22:15:43+00:00", "updated": "2026-02-02T19:27:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "4.16.0-9.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libtasn1@4.16.0-9.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-1371", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 404, 476 ], "description": "A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-1371" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-1371" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1371" }, { "url": "https://sourceware.org/bugzilla/attachment.cgi?id=15926" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32655" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32655#c2" }, { "url": "https://ubuntu.com/security/notices/USN-7369-1" }, { "url": "https://vuldb.com/?ctiid.295978" }, { "url": "https://vuldb.com/?id.295978" }, { "url": "https://vuldb.com/?submit.496484" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1371" }, { "url": "https://www.gnu.org/" } ], "published": "2025-02-17T03:15:09+00:00", "updated": "2025-11-04T20:13:36+00:00", "affects": [ { "ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-1376", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 404 ], "description": "A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-1376" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-1376" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1376" }, { "url": "https://sourceware.org/bugzilla/attachment.cgi?id=15940" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32672" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3" }, { "url": "https://vuldb.com/?ctiid.295984" }, { "url": "https://vuldb.com/?id.295984" }, { "url": "https://vuldb.com/?submit.497538" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1376" }, { "url": "https://www.gnu.org/" } ], "published": "2025-02-17T05:15:09+00:00", "updated": "2025-11-04T20:21:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-1377", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 404 ], "description": "A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-1377" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-1377" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1377" }, { "url": "https://sourceware.org/bugzilla/attachment.cgi?id=15941" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32673" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32673#c2" }, { "url": "https://ubuntu.com/security/notices/USN-7369-1" }, { "url": "https://vuldb.com/?ctiid.295985" }, { "url": "https://vuldb.com/?id.295985" }, { "url": "https://vuldb.com/?submit.497539" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1377" }, { "url": "https://www.gnu.org/" } ], "published": "2025-02-17T05:15:10+00:00", "updated": "2025-11-04T20:26:20+00:00", "affects": [ { "ref": "pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.193-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-default-yama-scope@0.193-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libelf@0.193-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/elfutils-libs@0.193-1.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-13837", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400 ], "description": "When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-13837" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-13837" }, { "url": "https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036" }, { "url": "https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b" }, { "url": "https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70" }, { "url": "https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba" }, { "url": "https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb" }, { "url": "https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111" }, { "url": "https://github.com/python/cpython/issues/119342" }, { "url": "https://github.com/python/cpython/pull/119343" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-13837" } ], "published": "2025-12-01T18:16:04+00:00", "updated": "2026-03-03T15:16:14+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-14017", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "description": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-14017" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/07/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14017" }, { "url": "https://curl.se/docs/CVE-2025-14017.html" }, { "url": "https://curl.se/docs/CVE-2025-14017.json" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14017" }, { "url": "https://ubuntu.com/security/notices/USN-8062-1" }, { "url": "https://ubuntu.com/security/notices/USN-8062-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14017" } ], "published": "2026-01-08T10:15:45+00:00", "updated": "2026-01-27T21:29:39+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-14087", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 9.8, "severity": "critical", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "photon" }, "severity": "critical" }, { "source": { "name": "redhat" }, "score": 5.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strings.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-14087" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14087" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419093" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3834" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4933" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4934" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14087" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14087" } ], "published": "2025-12-10T09:15:47+00:00", "updated": "2026-03-18T17:16:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-14512", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-14512" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14512" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421339" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3845" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4935" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4936" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14512" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14512" } ], "published": "2025-12-11T07:16:00+00:00", "updated": "2026-03-19T10:16:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-14831", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 407 ], "description": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).", "recommendation": "Upgrade gnutls to version 3.8.3-10.el9_7", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-14831" }, { "url": "https://access.redhat.com/errata/RHSA-2026:3477" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4188" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4655" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4943" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5585" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5606" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-14831" }, { "url": "https://bugzilla.redhat.com/2392528" }, { "url": "https://bugzilla.redhat.com/2423177" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14831" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9820" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-4188.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:4188" }, { "url": "https://gitlab.com/gnutls/gnutls/-/issues/1773" }, { "url": "https://linux.oracle.com/cve/CVE-2025-14831.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-5585.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831" }, { "url": "https://ubuntu.com/security/notices/USN-8043-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-14831" } ], "published": "2026-02-09T15:16:09+00:00", "updated": "2026-03-24T11:16:21+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.8.3-9.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-15282", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-15282" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-15282" }, { "url": "https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0" }, { "url": "https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38" }, { "url": "https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80" }, { "url": "https://github.com/python/cpython/commit/4ed11d3cd288e6b90196a15c5a825a45d318fe47" }, { "url": "https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a" }, { "url": "https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f" }, { "url": "https://github.com/python/cpython/issues/143925" }, { "url": "https://github.com/python/cpython/pull/143926" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15282" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15282" } ], "published": "2026-01-20T22:15:50+00:00", "updated": "2026-01-26T15:16:06+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-15366", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 77 ], "description": "The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.", "recommendation": "Upgrade python-unversioned-command to version 3.9.25-3.el9_7.1; Upgrade python3 to version 3.9.25-3.el9_7.1; Upgrade python3-libs to version 3.9.25-3.el9_7.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-15366" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4216" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-15366" }, { "url": "https://bugzilla.redhat.com/2431368" }, { "url": "https://bugzilla.redhat.com/2431373" }, { "url": "https://bugzilla.redhat.com/2432437" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15366" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15367" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1299" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-4216.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:4168" }, { "url": "https://github.com/python/cpython/commit/6262704b134db2a4ba12e85ecfbd968534f28b45" }, { "url": "https://github.com/python/cpython/issues/143921" }, { "url": "https://github.com/python/cpython/pull/143922" }, { "url": "https://linux.oracle.com/cve/CVE-2025-15366.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4713.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15366" } ], "published": "2026-01-20T22:15:51+00:00", "updated": "2026-01-26T15:05:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2025-15367", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 77 ], "description": "The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters.", "recommendation": "Upgrade python-unversioned-command to version 3.9.25-3.el9_7.1; Upgrade python3 to version 3.9.25-3.el9_7.1; Upgrade python3-libs to version 3.9.25-3.el9_7.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-15367" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4216" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-15367" }, { "url": "https://bugzilla.redhat.com/2431368" }, { "url": "https://bugzilla.redhat.com/2431373" }, { "url": "https://bugzilla.redhat.com/2432437" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15366" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15367" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1299" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-4216.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:4168" }, { "url": "https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7" }, { "url": "https://github.com/python/cpython/issues/143923" }, { "url": "https://github.com/python/cpython/pull/143924" }, { "url": "https://linux.oracle.com/cve/CVE-2025-15367.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4713.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-15367" } ], "published": "2026-01-20T22:15:51+00:00", "updated": "2026-01-26T15:05:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2025-1632", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 404, 476 ], "description": "A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-1632" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-1632" }, { "url": "https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1632" }, { "url": "https://ubuntu.com/security/notices/USN-7454-1" }, { "url": "https://vuldb.com/?ctiid.296619" }, { "url": "https://vuldb.com/?id.296619" }, { "url": "https://vuldb.com/?submit.496460" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1632" } ], "published": "2025-02-24T14:15:11+00:00", "updated": "2025-03-25T15:41:41+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-1795", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 116 ], "description": "During an address list folding when a separating comma ends up on a folded line and that line is to be unicode-encoded then the separator itself is also unicode-encoded. Expected behavior is that the separating comma remains a plan comma. This can result in the address header being misinterpreted by some mail servers.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-1795" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-1795" }, { "url": "https://github.com/python/cpython/commit/09fab93c3d857496c0bd162797fab816c311ee48" }, { "url": "https://github.com/python/cpython/commit/70754d21c288535e86070ca7a6e90dcb670b8593" }, { "url": "https://github.com/python/cpython/commit/9148b77e0af91cdacaa7fe3dfac09635c3fe9a74" }, { "url": "https://github.com/python/cpython/commit/a4ef689ce670684ec132204b1cd03720c8e0a03d" }, { "url": "https://github.com/python/cpython/commit/d4df3c55e4c5513947f907f24766b34d2ae8c090" }, { "url": "https://github.com/python/cpython/issues/100884" }, { "url": "https://github.com/python/cpython/pull/100885" }, { "url": "https://github.com/python/cpython/pull/119099" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/MB62IZMEC3UM6SGHP5LET5JX2Y7H4ZUR/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1795" }, { "url": "https://ubuntu.com/security/notices/USN-7570-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-1795" } ], "published": "2025-02-28T19:15:36+00:00", "updated": "2025-11-03T21:18:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-27113", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-27113" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/10" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/11" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/12" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/13" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/4" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/5" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/8" }, { "url": "http://seclists.org/fulldisclosure/2025/Apr/9" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-27113" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/861" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00028.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27113" }, { "url": "https://security.netapp.com/advisory/ntap-20250306-0004/" }, { "url": "https://ubuntu.com/security/notices/USN-7302-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-27113" }, { "url": "https://www.openwall.com/lists/oss-security/2025/02/18/2" } ], "published": "2025-02-18T23:15:10+00:00", "updated": "2025-11-03T22:18:43+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-28164", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 401, 120 ], "description": "Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-28164" }, { "url": "https://gist.github.com/kittener/506516f8c22178005b4379c8b2a7de20" }, { "url": "https://github.com/pnggroup/libpng/issues/655" }, { "url": "https://github.com/pnggroup/libpng/pull/657" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28164" }, { "url": "https://ubuntu.com/security/notices/USN-7993-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-28164" } ], "published": "2026-01-27T16:16:14+00:00", "updated": "2026-03-04T19:42:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-30258", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 2.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 754 ], "description": "In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a \"verification DoS.\"", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-30258" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-30258" }, { "url": "https://dev.gnupg.org/T7527" }, { "url": "https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158" }, { "url": "https://lists.gnupg.org/pipermail/gnupg-announce/2025q1/000491.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30258" }, { "url": "https://ubuntu.com/security/notices/USN-7412-1" }, { "url": "https://ubuntu.com/security/notices/USN-7412-3" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-30258" } ], "published": "2025-03-19T20:15:20+00:00", "updated": "2025-10-16T16:53:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.3.3-5.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-3360", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 190 ], "description": "A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-3360" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-3360" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2357754" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00024.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3360" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-3360" } ], "published": "2025-04-07T13:15:43+00:00", "updated": "2025-04-14T12:15:16+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-4516", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 5.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "There is an issue in CPython when using `bytes.decode(\"unicode_escape\", error=\"ignore|replace\")`. If you are not using the \"unicode_escape\" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-4516" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/16/4" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/19/1" }, { "url": "https://access.redhat.com/errata/RHSA-2025:23530" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-4516" }, { "url": "https://bugzilla.redhat.com/2294682" }, { "url": "https://bugzilla.redhat.com/2321440" }, { "url": "https://bugzilla.redhat.com/2325776" }, { "url": "https://bugzilla.redhat.com/2343237" }, { "url": "https://bugzilla.redhat.com/2366509" }, { "url": "https://bugzilla.redhat.com/2370010" }, { "url": "https://bugzilla.redhat.com/2370014" }, { "url": "https://bugzilla.redhat.com/2370016" }, { "url": "https://bugzilla.redhat.com/2372426" }, { "url": "https://bugzilla.redhat.com/2373234" }, { "url": "https://bugzilla.redhat.com/2402342" }, { "url": "https://bugzilla.redhat.com/2408891" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2294682" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2321440" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325776" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2343237" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2366509" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370010" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370014" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370016" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372426" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373234" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2402342" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2408891" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11168" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5642" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9287" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0938" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4138" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4330" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4435" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4516" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4517" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6069" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6075" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8291" }, { "url": "https://errata.almalinux.org/8/ALSA-2025-23530.html" }, { "url": "https://errata.rockylinux.org/RLSA-2025:23530" }, { "url": "https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292" }, { "url": "https://github.com/python/cpython/commit/5646648678295a44aa82636c6e92826651baf33a" }, { "url": "https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d" }, { "url": "https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142" }, { "url": "https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f" }, { "url": "https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77" }, { "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e" }, { "url": "https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e" }, { "url": "https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b" }, { "url": "https://github.com/python/cpython/issues/133767" }, { "url": "https://github.com/python/cpython/pull/129648" }, { "url": "https://linux.oracle.com/cve/CVE-2025-4516.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2025-23530.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4516" }, { "url": "https://ubuntu.com/security/notices/USN-7570-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-4516" } ], "published": "2025-05-15T14:15:31+00:00", "updated": "2025-06-03T14:15:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-50181", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 601 ], "description": "urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-50181" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-50181" }, { "url": "https://github.com/urllib3/urllib3" }, { "url": "https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0" }, { "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50181" }, { "url": "https://ubuntu.com/security/notices/USN-7599-1" }, { "url": "https://ubuntu.com/security/notices/USN-7599-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-50181" } ], "published": "2025-06-19T01:15:24+00:00", "updated": "2025-12-22T19:15:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)" } }, { "id": "CVE-2025-50182", "ratings": [ { "source": { "name": "ghsa" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "nvd" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 601 ], "description": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-50182" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-50182" }, { "url": "https://github.com/urllib3/urllib3" }, { "url": "https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f" }, { "url": "https://github.com/urllib3/urllib3/releases/tag/2.5.0" }, { "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-50182" }, { "url": "https://ubuntu.com/security/notices/USN-7599-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-50182" } ], "published": "2025-06-19T02:15:17+00:00", "updated": "2025-12-22T19:15:49+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)" } }, { "id": "CVE-2025-5278", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" } ], "cwes": [ 121 ], "description": "A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-5278" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/27/2" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/29/1" }, { "url": "http://www.openwall.com/lists/oss-security/2025/05/29/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-5278" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368764" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/tree/NEWS?id=8c9602e3a145e9596dc1a63c6ed67865814b6633#n14" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278" }, { "url": "https://security-tracker.debian.org/tracker/CVE-2025-5278" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5278" } ], "published": "2025-05-27T21:15:23+00:00", "updated": "2025-10-22T20:15:37+00:00", "affects": [ { "ref": "pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "8.32-39.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/coreutils-single@8.32-39.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-5915", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 6.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.6, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 122 ], "description": "A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-5915" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-5915" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865" }, { "url": "https://github.com/libarchive/libarchive/pull/2599" }, { "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5915" }, { "url": "https://ubuntu.com/security/notices/USN-7601-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5915" } ], "published": "2025-06-09T20:15:26+00:00", "updated": "2026-01-08T04:15:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-5916", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-5916" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-5916" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370872" }, { "url": "https://github.com/libarchive/libarchive/pull/2568" }, { "url": "https://github.com/libarchive/libarchive/pull/2568/commits/bce70c4c26864df2a8d6953e7db6e4b156253508" }, { "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5916" }, { "url": "https://ubuntu.com/security/notices/USN-7601-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5916" } ], "published": "2025-06-09T20:15:27+00:00", "updated": "2025-12-12T01:15:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-5917", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 2.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-5917" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-5917" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370874" }, { "url": "https://github.com/libarchive/libarchive/pull/2588" }, { "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5917" }, { "url": "https://ubuntu.com/security/notices/USN-7601-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5917" } ], "published": "2025-06-09T20:15:27+00:00", "updated": "2025-12-12T01:15:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-5918", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 6.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L" } ], "cwes": [ 125 ], "description": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-5918" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-5918" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877" }, { "url": "https://github.com/libarchive/libarchive/pull/2584" }, { "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5918" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-5918" } ], "published": "2025-06-09T20:15:27+00:00", "updated": "2025-08-15T18:35:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-60753", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 835 ], "description": "An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-60753" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-60753" }, { "url": "https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753" }, { "url": "https://github.com/libarchive/libarchive/issues/2725" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60753" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-60753" } ], "published": "2025-11-05T16:15:40+00:00", "updated": "2026-02-04T21:19:45+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-6170", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 121 ], "description": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-6170" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-6170" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00014.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170" }, { "url": "https://ubuntu.com/security/notices/USN-7694-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-6170" } ], "published": "2025-06-16T16:15:20+00:00", "updated": "2026-03-24T05:16:23+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-64118", "ratings": [ { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 362, 367 ], "description": "node-tar is a Tar for Node.js. In 7.5.1, using .t (aka .list) with { sync: true } to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64118" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64118" }, { "url": "https://github.com/isaacs/node-tar" }, { "url": "https://github.com/isaacs/node-tar/commit/5330eb04bc43014f216e5c271b40d5c00d45224d" }, { "url": "https://github.com/isaacs/node-tar/commit/5e1a8e638600d3c3a2969b4de6a6ec44fa8d74c9" }, { "url": "https://github.com/isaacs/node-tar/issues/445" }, { "url": "https://github.com/isaacs/node-tar/pull/446" }, { "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-29xp-372q-xqph" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64118" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64118" } ], "published": "2025-10-30T18:15:33+00:00", "updated": "2025-11-04T15:41:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.34-9.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-64505", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when processing PNG files with malformed palette indices. The vulnerability occurs when palette_lookup array bounds are not validated against externally-supplied image data, allowing an attacker to craft a PNG file with out-of-range palette indices that trigger out-of-bounds memory access. This issue has been patched in version 1.6.51.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64505" }, { "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37" }, { "url": "https://github.com/pnggroup/libpng/commit/6a528eb5fd0dd7f6de1c39d30de0e41473431c37" }, { "url": "https://github.com/pnggroup/libpng/pull/748" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-4952-h5wq-4m42" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64505" }, { "url": "https://ubuntu.com/security/notices/USN-7924-1" }, { "url": "https://ubuntu.com/security/notices/USN-8081-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64505" }, { "url": "https://www.openwall.com/lists/oss-security/2025/11/22/1" } ], "published": "2025-11-25T00:15:47+00:00", "updated": "2025-11-26T18:28:32+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-64506", "ratings": [ { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_write_image_8bit function when processing 8-bit images through the simplified write API with convert_to_8bit enabled. The vulnerability affects 8-bit grayscale+alpha, RGB/RGBA, and images with incomplete row data. A conditional guard incorrectly allows 8-bit input to enter code expecting 16-bit input, causing reads up to 2 bytes beyond allocated buffer boundaries. This issue has been patched in version 1.6.51.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-64506" }, { "url": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821" }, { "url": "https://github.com/pnggroup/libpng/commit/2bd84c019c300b78e811743fbcddb67c9d9bf821" }, { "url": "https://github.com/pnggroup/libpng/pull/749" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-qpr4-xm66-hww6" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64506" }, { "url": "https://ubuntu.com/security/notices/USN-7924-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-64506" }, { "url": "https://www.openwall.com/lists/oss-security/2025/11/22/1" } ], "published": "2025-11-25T00:15:47+00:00", "updated": "2025-11-26T18:34:38+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-66382", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 407 ], "description": "In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-66382" }, { "url": "http://www.openwall.com/lists/oss-security/2025/12/02/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-66382" }, { "url": "https://github.com/libexpat/libexpat/issues/1076" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66382" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-66382" } ], "published": "2025-11-28T07:15:57+00:00", "updated": "2025-12-19T16:05:03+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.5.0-5.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-68972", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 347 ], "description": "In GnuPG through 2.4.8, if a signed message has \\f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an \"invalid armor\" message is printed during verification). This is related to use of \\f as a marker to denote truncation of a long plaintext line.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-68972" }, { "url": "https://gpg.fail/formfeed" }, { "url": "https://media.ccc.de/v/39c3-to-sign-or-not-to-sign-practical-vulnerabilities-i" }, { "url": "https://news.ycombinator.com/item?id=46404339" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68972" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-68972" } ], "published": "2025-12-27T23:15:40+00:00", "updated": "2026-01-09T20:08:47+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.3.3-5.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-7039", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 22 ], "description": "A flaw was found in glib. An integer overflow during temporary file creation leads to an out-of-bounds memory access, allowing an attacker to potentially perform path traversal or access private temporary file content by creating symbolic links. This vulnerability allows a local attacker to manipulate file paths and access unauthorized data. The core issue stems from insufficient validation of file path lengths during temporary file operations.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-7039" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-7039" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392423" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7039" }, { "url": "https://ubuntu.com/security/notices/USN-7942-1" }, { "url": "https://ubuntu.com/security/notices/USN-7942-2" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-7039" } ], "published": "2025-09-03T02:15:38+00:00", "updated": "2025-09-04T15:36:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-70873", "ratings": [ { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" } ], "cwes": [ 244 ], "description": "An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-70873" }, { "url": "https://gist.github.com/cnwangjihe/f496393f30f5ecec5b18c8f5ab072054" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-70873" }, { "url": "https://sqlite.org/forum/forumpost/761eac3c82" }, { "url": "https://sqlite.org/src/info/3d459f1fb1bd1b5e" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-70873" } ], "published": "2026-03-12T19:16:15+00:00", "updated": "2026-03-16T14:18:02+00:00", "affects": [ { "ref": "pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.34.1-9.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/sqlite-libs@3.34.1-9.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-9232", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 125 ], "description": "Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "url": "http://www.openwall.com/lists/oss-security/2025/09/30/5" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-9232" }, { "url": "https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35" }, { "url": "https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b" }, { "url": "https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3" }, { "url": "https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf" }, { "url": "https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9232" }, { "url": "https://openssl-library.org/news/secadv/20250930.txt" }, { "url": "https://ubuntu.com/security/notices/USN-7786-1" }, { "url": "https://ubuntu.com/security/notices/USN-7894-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-9232" } ], "published": "2025-09-30T14:15:41+00:00", "updated": "2025-11-04T22:16:45+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-9820", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 121 ], "description": "A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.", "recommendation": "Upgrade gnutls to version 3.8.3-10.el9_7", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-9820" }, { "url": "http://www.openwall.com/lists/oss-security/2025/11/20/2" }, { "url": "https://access.redhat.com/errata/RHSA-2026:3477" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4188" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4655" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4943" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5585" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5606" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-9820" }, { "url": "https://bugzilla.redhat.com/2392528" }, { "url": "https://bugzilla.redhat.com/2423177" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392528" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14831" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9820" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-4188.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:4188" }, { "url": "https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5" }, { "url": "https://gitlab.com/gnutls/gnutls/-/issues/1732" }, { "url": "https://linux.oracle.com/cve/CVE-2025-9820.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-5585.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9820" }, { "url": "https://ubuntu.com/security/notices/USN-8043-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-9820" }, { "url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18" } ], "published": "2026-01-26T20:16:09+00:00", "updated": "2026-03-24T11:16:22+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.8.3-9.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gnutls@3.8.3-9.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-0672", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0672" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0672" }, { "url": "https://github.com/python/cpython/commit/62700107418eb2cca3fc88da036a243ea975f172" }, { "url": "https://github.com/python/cpython/commit/712452e6f1d4b9f7f8c4c92ebfcaac1705faa440" }, { "url": "https://github.com/python/cpython/commit/7852d72b653fea0199acf5fc2a84f6f8b84eba8d" }, { "url": "https://github.com/python/cpython/commit/918387e4912d12ffc166c8f2a38df92b6ec756ca" }, { "url": "https://github.com/python/cpython/commit/95746b3a13a985787ef53b977129041971ed7f70" }, { "url": "https://github.com/python/cpython/commit/b1869ff648bbee0717221d09e6deff46617f3e85" }, { "url": "https://github.com/python/cpython/issues/143919" }, { "url": "https://github.com/python/cpython/pull/143920" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6VFLQQEIX673KXKFUZXCUNE5AZOGZ45M/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0672" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0672" } ], "published": "2026-01-20T22:15:52+00:00", "updated": "2026-01-26T15:16:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-0865", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 74 ], "description": "User-controlled header names and values containing newlines can allow injecting HTTP headers.", "recommendation": "Upgrade python-unversioned-command to version 3.9.25-3.el9_7.1; Upgrade python3 to version 3.9.25-3.el9_7.1; Upgrade python3-libs to version 3.9.25-3.el9_7.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0865" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4168" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0865" }, { "url": "https://bugzilla.redhat.com/2431368" }, { "url": "https://bugzilla.redhat.com/2431373" }, { "url": "https://bugzilla.redhat.com/2432437" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15366" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15367" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1299" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-4168.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:4168" }, { "url": "https://github.com/python/cpython/commit/22e4d55285cee52bc4dbe061324e5f30bd4dee58" }, { "url": "https://github.com/python/cpython/commit/23e3c0ae867cca0130e441e776c9955b9027c510" }, { "url": "https://github.com/python/cpython/commit/286e3ac39984fe85a17f4ab39c64d382137aae5f" }, { "url": "https://github.com/python/cpython/commit/2f840249550e082dc351743f474ba56da10478d2" }, { "url": "https://github.com/python/cpython/commit/4802b96a2cde58570c24c13ef3289490980961c5" }, { "url": "https://github.com/python/cpython/commit/66da7bf6fe7b81e3ecc9c0a25bd47d4616c8d1a6" }, { "url": "https://github.com/python/cpython/commit/83ecd18779f286d872f68bfce175651e407d9fff" }, { "url": "https://github.com/python/cpython/commit/8bb044d29310bb05d15086cdaa8bf64867d61a97" }, { "url": "https://github.com/python/cpython/commit/bfba660085767f8c2d582134e9d511a85eda04cf" }, { "url": "https://github.com/python/cpython/commit/c592227ffb48679af9845a45dbb0875d975bb219" }, { "url": "https://github.com/python/cpython/commit/e4846a93ac07a8ae9aa18203af0dd13d6e7a6995" }, { "url": "https://github.com/python/cpython/commit/f7fceed79ca1bceae8dbe5ba5bc8928564da7211" }, { "url": "https://github.com/python/cpython/issues/143916" }, { "url": "https://github.com/python/cpython/pull/143917" }, { "url": "https://linux.oracle.com/cve/CVE-2026-0865.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4713.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/BJ6QPHNSHJTS3A7CFV6IBMCAP2DWRVNT/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0865" }, { "url": "https://ubuntu.com/security/notices/USN-8018-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0865" } ], "published": "2026-01-20T22:15:52+00:00", "updated": "2026-03-03T15:16:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-0988", "ratings": [ { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 190 ], "description": "A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0988" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0988" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429886" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3851" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0988" }, { "url": "https://ubuntu.com/security/notices/USN-7971-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0988" } ], "published": "2026-01-21T12:15:55+00:00", "updated": "2026-03-19T10:16:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-0989", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0989" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0989" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429933" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0989" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0989" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-01-16T15:55:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-0990", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 674 ], "description": "A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this configuration-dependent issue by providing a specially crafted XML catalog, leading to infinite recursion and call stack exhaustion. This ultimately results in a segmentation fault, causing a Denial of Service (DoS) by crashing affected applications.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0990" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0990" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429959" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0990" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0990" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-01-16T15:55:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-0992", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 400 ], "description": "A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-0992" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-0992" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2429975" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0992" }, { "url": "https://ubuntu.com/security/notices/USN-7974-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-0992" } ], "published": "2026-01-15T15:15:52+00:00", "updated": "2026-01-16T15:55:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-1299", "ratings": [ { "source": { "name": "alma" }, "severity": "medium" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "oracle-oval" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N" }, { "source": { "name": "rocky" }, "severity": "medium" } ], "cwes": [ 93 ], "description": "The \nemail module, specifically the \"BytesGenerator\" class, didn\u2019t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized. This is only applicable if using \"LiteralHeader\" writing headers that don't respect email folding rules, the new behavior will reject the incorrectly folded headers in \"BytesGenerator\".", "recommendation": "Upgrade python-unversioned-command to version 3.9.25-3.el9_7.1; Upgrade python3 to version 3.9.25-3.el9_7.1; Upgrade python3-libs to version 3.9.25-3.el9_7.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1299" }, { "url": "https://access.redhat.com/errata/RHSA-2026:4216" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1299" }, { "url": "https://bugzilla.redhat.com/2431368" }, { "url": "https://bugzilla.redhat.com/2431373" }, { "url": "https://bugzilla.redhat.com/2432437" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431367" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15366" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15367" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1299" }, { "url": "https://cve.org/CVERecord?id=CVE-2024-6923" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-4216.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:4168" }, { "url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413" }, { "url": "https://github.com/python/cpython/commit/0a925ab591c45d6638f37b5e57796f36fa0e56d8" }, { "url": "https://github.com/python/cpython/commit/7877fe424415bc4a13045e62a90a7277413d8cb9" }, { "url": "https://github.com/python/cpython/commit/842ce19a0c0b58d61591e8f6a708c38db1fb94e4" }, { "url": "https://github.com/python/cpython/commit/8cdf6204f4ae821f32993f8fc6bad0d318f95f36" }, { "url": "https://github.com/python/cpython/commit/e417f05ad77a4c30ddc07f99e90fc0cef43e831a" }, { "url": "https://github.com/python/cpython/issues/144125" }, { "url": "https://github.com/python/cpython/pull/144126" }, { "url": "https://linux.oracle.com/cve/CVE-2026-1299.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4713.html" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1299" } ], "published": "2026-01-23T17:16:12+00:00", "updated": "2026-02-13T17:16:12+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-1484", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 4.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A flaw was found in the GLib Base64 encoding routine when processing very large input data. Due to incorrect use of integer types during length calculation, the library may miscalculate buffer boundaries. This can cause memory writes outside the allocated buffer. Applications that process untrusted or extremely large Base64 input using GLib may crash or behave unpredictably.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1484" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1484" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433259" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3870" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1484" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1484" } ], "published": "2026-01-27T14:15:56+00:00", "updated": "2026-03-19T10:16:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-1485", "ratings": [ { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.8, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 124 ], "description": "A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1485" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1485" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433325" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3871" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1485" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1485" } ], "published": "2026-01-27T14:15:56+00:00", "updated": "2026-03-18T17:16:05+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-1489", "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 787 ], "description": "A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1489" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1489" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433348" }, { "url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3872" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1489" }, { "url": "https://ubuntu.com/security/notices/USN-8017-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1489" } ], "published": "2026-01-27T15:15:57+00:00", "updated": "2026-03-19T10:16:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.68.4-18.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glib2@2.68.4-18.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-1757", "ratings": [ { "source": { "name": "amazon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 401 ], "description": "A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1757" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1757" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2435940" }, { "url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/1009" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1757" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1757" } ], "published": "2026-02-02T13:15:58+00:00", "updated": "2026-03-12T13:16:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.9.13-14.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libxml2@2.9.13-14.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-1965", "ratings": [ { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 305 ], "description": "libcurl can in some circumstances reuse the wrong connection when asked to do\nan Negotiate-authenticated HTTP or HTTPS request.\n\nlibcurl features a pool of recent connections so that subsequent requests can\nreuse an existing connection to avoid overhead.\n\nWhen reusing a connection a range of criterion must first be met. Due to a\nlogical error in the code, a request that was issued by an application could\nwrongfully reuse an existing connection to the same server that was\nauthenticated using different credentials. One underlying reason being that\nNegotiate sometimes authenticates *connections* and not *requests*, contrary\nto how HTTP is designed to work.\n\nAn application that allows Negotiate authentication to a server (that responds\nwanting Negotiate) with `user1:password1` and then does another operation to\nthe same server also using Negotiate but with `user2:password2` (while the\nprevious connection is still alive) - the second request wrongly reused the\nsame connection and since it then sees that the Negotiate negotiation is\nalready made, it just sends the request over that connection thinking it uses\nthe user2 credentials when it is in fact still using the connection\nauthenticated for user1...\n\nThe set of authentication methods to use is set with `CURLOPT_HTTPAUTH`.\n\nApplications can disable libcurl's reuse of connections and thus mitigate this\nproblem, by using one of the following libcurl options to alter how\nconnections are or are not reused: `CURLOPT_FRESH_CONNECT`,\n`CURLOPT_MAXCONNECTS` and `CURLMOPT_MAX_HOST_CONNECTIONS` (if using the\ncurl_multi API).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1965" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1965" }, { "url": "https://curl.se/docs/CVE-2026-1965.html" }, { "url": "https://curl.se/docs/CVE-2026-1965.json" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1965" }, { "url": "https://ubuntu.com/security/notices/USN-8084-1" }, { "url": "https://ubuntu.com/security/notices/USN-8099-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1965" } ], "published": "2026-03-11T11:15:59+00:00", "updated": "2026-03-12T14:11:19+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-2100", "ratings": [ { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 824 ], "description": "A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-2100" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437308" }, { "url": "https://github.com/p11-glue/p11-kit/pull/740" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2100" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2100" } ], "published": "2026-03-26T21:17:04+00:00", "updated": "2026-03-30T13:26:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.25.3-3.el9_5", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "0.25.3-3.el9_5", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/p11-kit-trust@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/p11-kit@0.25.3-3.el9_5?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-22185", "ratings": [ { "source": { "name": "redhat" }, "score": 6.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125, 191 ], "description": "OpenLDAP Lightning Memory-Mapped Database (LMDB) versions up to and including 0.9.14, prior to commit 8e1fda8, contain a heap buffer underflow in the readline() function of mdb_load. When processing malformed input containing an embedded NUL byte, an unsigned offset calculation can underflow and cause an out-of-bounds read of one byte before the allocated heap buffer. This can cause mdb_load to crash, leading to a limited denial-of-service condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22185" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22185" }, { "url": "https://bugs.openldap.org/show_bug.cgi?id=10421" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22185" }, { "url": "https://seclists.org/fulldisclosure/2026/Jan/5" }, { "url": "https://seclists.org/fulldisclosure/2026/Jan/8" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22185" }, { "url": "https://www.openldap.org/" }, { "url": "https://www.vulncheck.com/advisories/openldap-lmdb-mdb-load-heap-buffer-underflow-in-readline" } ], "published": "2026-01-07T21:16:01+00:00", "updated": "2026-01-14T18:16:42+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.6.8-4.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openldap@2.6.8-4.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-22693", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 476 ], "description": "HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/11/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/01/12/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22693" }, { "url": "https://github.com/harfbuzz/harfbuzz/commit/1265ff8d990284f04d8768f35b0e20ae5f60daae" }, { "url": "https://github.com/harfbuzz/harfbuzz/security/advisories/GHSA-xvjr-f2r9-c7ww" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22693" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22693" } ], "published": "2026-01-10T06:15:52+00:00", "updated": "2026-02-18T17:49:22+00:00", "affects": [ { "ref": "pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.7.4-10.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/harfbuzz@2.7.4-10.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-22695", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.51 to 1.6.53, there is a heap buffer over-read in the libpng simplified API function png_image_finish_read when processing interlaced 16-bit PNGs with 8-bit output format and non-minimal row stride. This is a regression introduced by the fix for CVE-2025-65018. This vulnerability is fixed in 1.6.54.", "recommendation": "Upgrade libpng to version 2:1.6.37-12.el9_7.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22695" }, { "url": "https://access.redhat.com/errata/RHSA-2026:3405" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22695" }, { "url": "https://bugzilla.redhat.com/2428824" }, { "url": "https://bugzilla.redhat.com/2428825" }, { "url": "https://bugzilla.redhat.com/2438542" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-3405.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:3405" }, { "url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea" }, { "url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2" }, { "url": "https://github.com/pnggroup/libpng/issues/778" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp" }, { "url": "https://linux.oracle.com/cve/CVE-2026-22695.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4728.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695" }, { "url": "https://ubuntu.com/security/notices/USN-7963-1" }, { "url": "https://ubuntu.com/security/notices/USN-8035-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22695" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/12/7" } ], "published": "2026-01-12T23:15:52+00:00", "updated": "2026-01-21T18:58:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)" } }, { "id": "CVE-2026-22801", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125, 190 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.6.26 to 1.6.53, there is an integer truncation in the libpng simplified write API functions png_write_image_16bit and png_write_image_8bit causes heap buffer over-read when the caller provides a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes. The bug was introduced in libpng 1.6.26 (October 2016) by casts added to silence compiler warnings on 16-bit systems. This vulnerability is fixed in 1.6.54.", "recommendation": "Upgrade libpng to version 2:1.6.37-12.el9_7.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-22801" }, { "url": "https://access.redhat.com/errata/RHSA-2026:3405" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-22801" }, { "url": "https://bugzilla.redhat.com/2428824" }, { "url": "https://bugzilla.redhat.com/2428825" }, { "url": "https://bugzilla.redhat.com/2438542" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-3405.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:3405" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8" }, { "url": "https://linux.oracle.com/cve/CVE-2026-22801.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4728.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801" }, { "url": "https://ubuntu.com/security/notices/USN-7963-1" }, { "url": "https://ubuntu.com/security/notices/USN-8035-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-22801" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/12/7" } ], "published": "2026-01-12T23:15:52+00:00", "updated": "2026-01-21T18:58:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": "Exploitability analysis, additional details:\nTemurin JVM binary is linked only against glibc:\n$ ldd /usr/lib/jvm/temurin-17-jre/bin/java\n linux-vdso.so.1 (0x0000ffff8cd00000)\n libjli.so => /usr/lib/jvm/temurin-17-jre/bin/../lib/libjli.so (0x0000ffff8cc70000)\n libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff8cc3b000)\n libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff8cc1a000)\n libc.so.6 => /lib64/libc.so.6 (0x0000ffff8caa4000)\n /lib/ld-linux-aarch64.so.1 (0x0000ffff8ccc2000)" } }, { "id": "CVE-2026-2297", "ratings": [ { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 668 ], "description": "The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-2297" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/05/6" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-2297" }, { "url": "https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e" }, { "url": "https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e" }, { "url": "https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86" }, { "url": "https://github.com/python/cpython/issues/145506" }, { "url": "https://github.com/python/cpython/pull/145507" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2297" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2297" } ], "published": "2026-03-04T23:16:10+00:00", "updated": "2026-03-12T15:16:27+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-23865", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 125 ], "description": "An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-23865" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/03/8" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-23865" }, { "url": "https://gitlab.com/freetype/freetype/-/commit/fc85a255849229c024c8e65f536fe1875d84841c" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23865" }, { "url": "https://sourceforge.net/projects/freetype/files/freetype2/2.14.2/" }, { "url": "https://ubuntu.com/security/notices/USN-8086-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-23865" }, { "url": "https://www.facebook.com/security/advisories/cve-2026-23865" } ], "published": "2026-03-02T17:16:32+00:00", "updated": "2026-03-04T01:15:55+00:00", "affects": [ { "ref": "pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.10.4-10.el9_5", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/freetype@2.10.4-10.el9_5?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-23949", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 8.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "source": { "name": "redhat" }, "score": 8.6, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 22 ], "description": "jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.", "recommendation": "Upgrade jaraco.context to version 6.1.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-23949" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-23949" }, { "url": "https://github.com/jaraco/jaraco.context" }, { "url": "https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91" }, { "url": "https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9" }, { "url": "https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2" }, { "url": "https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23949" }, { "url": "https://ubuntu.com/security/notices/USN-7979-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-23949" } ], "published": "2026-01-20T01:15:57+00:00", "updated": "2026-03-11T23:12:19+00:00", "affects": [ { "ref": "pkg:pypi/jaraco.context@5.3.0", "versions": [ { "version": "5.3.0", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:pypi/jaraco.context@5.3.0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:pypi/jaraco.context@5.3.0" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-24049", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "high" }, { "source": { "name": "ghsa" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 22, 732 ], "description": "wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files), allowing for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. This issue has been fixed in version 0.46.2.", "recommendation": "Upgrade wheel to version 0.46.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-24049" }, { "url": "https://access.redhat.com/errata/RHSA-2026:1939" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-24049" }, { "url": "https://bugzilla.redhat.com/2431959" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431959" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24049" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-1939.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:1939" }, { "url": "https://github.com/pypa/wheel" }, { "url": "https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef" }, { "url": "https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e" }, { "url": "https://github.com/pypa/wheel/releases/tag/0.46.2" }, { "url": "https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx" }, { "url": "https://linux.oracle.com/cve/CVE-2026-24049.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-2090.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24049" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-24049" } ], "published": "2026-01-22T05:16:23+00:00", "updated": "2026-02-18T14:56:48+00:00", "affects": [ { "ref": "pkg:pypi/wheel@0.45.1", "versions": [ { "version": "0.45.1", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:pypi/wheel@0.45.1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:pypi/wheel@0.45.1" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-24515", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "cbl-mariner" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "photon" }, "severity": "low" }, { "source": { "name": "redhat" }, "score": 2.9, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 476 ], "description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-24515" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-24515" }, { "url": "https://github.com/libexpat/libexpat/pull/1131" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24515" }, { "url": "https://ubuntu.com/security/notices/USN-8022-1" }, { "url": "https://ubuntu.com/security/notices/USN-8022-2" }, { "url": "https://ubuntu.com/security/notices/USN-8023-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-24515" } ], "published": "2026-01-23T08:16:01+00:00", "updated": "2026-02-05T17:27:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.5.0-5.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-24883", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 476 ], "description": "In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return success with sig->data[] set to a NULL value, leading to a denial of service (application crash).", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-24883" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-24883" }, { "url": "https://dev.gnupg.org/T8049" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24883" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-24883" }, { "url": "https://www.openwall.com/lists/oss-security/2026/01/27/8" } ], "published": "2026-01-27T19:16:16+00:00", "updated": "2026-02-06T18:06:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.3.3-5.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/gnupg2@2.3.3-5.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-25068", "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "cbl-mariner" }, "severity": "medium" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 4.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 129 ], "description": "alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in the topology mixer control decoder. The tplg_decode_control_mixer1() function reads the num_channels field from untrusted .tplg data and uses it as a loop bound without validating it against the fixed-size channel array (SND_TPLG_MAX_CHAN). A crafted topology file with an excessive num_channels value can cause out-of-bounds heap writes, leading to a crash.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25068" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25068" }, { "url": "https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40" }, { "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00008.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25068" }, { "url": "https://ubuntu.com/security/notices/USN-8044-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25068" }, { "url": "https://www.vulncheck.com/advisories/alsa-lib-topology-decoder-heap-based-buffer-overflow" } ], "published": "2026-01-29T20:16:10+00:00", "updated": "2026-02-06T01:15:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "1.2.14-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/alsa-lib@1.2.14-1.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-25645", "ratings": [ { "source": { "name": "ghsa" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 4.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 377 ], "description": "Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulnerability. Only applications that call `extract_zipped_paths()` directly are impacted. Starting in version 2.33.0, the library extracts files to a non-deterministic location. If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.", "recommendation": "; Upgrade requests to version 2.33.0", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25645" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25645" }, { "url": "https://github.com/psf/requests" }, { "url": "https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7" }, { "url": "https://github.com/psf/requests/releases/tag/v2.33.0" }, { "url": "https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25645" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25645" } ], "published": "2026-03-25T17:16:52+00:00", "updated": "2026-03-30T14:23:16+00:00", "affects": [ { "ref": "pkg:pypi/requests@2.32.5", "versions": [ { "version": "2.32.5", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:pypi/requests@2.32.5" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ] }, { "id": "CVE-2026-25646", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "nvd" }, "score": 8.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H" }, { "source": { "name": "rocky" }, "severity": "high" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 122, 126 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55.", "recommendation": "Upgrade libpng to version 2:1.6.37-12.el9_7.2", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25646" }, { "url": "http://www.openwall.com/lists/oss-security/2026/02/09/7" }, { "url": "https://access.redhat.com/errata/RHSA-2026:3405" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25646" }, { "url": "https://bugzilla.redhat.com/2428824" }, { "url": "https://bugzilla.redhat.com/2428825" }, { "url": "https://bugzilla.redhat.com/2438542" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22695" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22801" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25646" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-3405.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:3405" }, { "url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3" }, { "url": "https://linux.oracle.com/cve/CVE-2026-25646.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-4756.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646" }, { "url": "https://ubuntu.com/security/notices/USN-8035-1" }, { "url": "https://ubuntu.com/security/notices/USN-8039-1" }, { "url": "https://ubuntu.com/security/notices/USN-8081-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25646" } ], "published": "2026-02-10T18:16:37+00:00", "updated": "2026-02-13T20:43:44+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-2673", "ratings": [ { "source": { "name": "redhat" }, "score": 3.1, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 757 ], "description": "Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected\npreferred key exchange group when its key exchange group configuration includes\nthe default by using the 'DEFAULT' keyword.\n\nImpact summary: A less preferred key exchange may be used even when a more\npreferred group is supported by both client and server, if the group\nwas not included among the client's initial predicated keyshares.\nThis will sometimes be the case with the new hybrid post-quantum groups,\nif the client chooses to defer their use until specifically requested by\nthe server.\n\nIf an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to\ninterpolate the built-in default group list into its own configuration, perhaps\nadding or removing specific elements, then an implementation defect causes the\n'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups\nwere treated as a single sufficiently secure 'tuple', with the server not\nsending a Hello Retry Request (HRR) even when a group in a more preferred tuple\nwas mutually supported.\n\nAs a result, the client and server might fail to negotiate a mutually supported\npost-quantum key agreement group, such as 'X25519MLKEM768', if the client's\nconfiguration results in only 'classical' groups (such as 'X25519' being the\nonly ones in the client's initial keyshare prediction).\n\nOpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS\n1.3 key agreement group on TLS servers. The old syntax had a single 'flat'\nlist of groups, and treated all the supported groups as sufficiently secure.\nIf any of the keyshares predicted by the client were supported by the server\nthe most preferred among these was selected, even if other groups supported by\nthe client, but not included in the list of predicted keyshares would have been\nmore preferred, if included.\n\nThe new syntax partitions the groups into distinct 'tuples' of roughly\nequivalent security. Within each tuple the most preferred group included among\nthe client's predicted keyshares is chosen, but if the client supports a group\nfrom a more preferred tuple, but did not predict any corresponding keyshares,\nthe server will ask the client to retry the ClientHello (by issuing a Hello\nRetry Request or HRR) with the most preferred mutually supported group.\n\nThe above works as expected when the server's configuration uses the built-in\ndefault group list, or explicitly defines its own list by directly defining the\nvarious desired groups and group 'tuples'.\n\nNo OpenSSL FIPS modules are affected by this issue, the code in question lies\noutside the FIPS boundary.\n\nOpenSSL 3.6 and 3.5 are vulnerable to this issue.\n\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released.\n\nOpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-2673" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/13/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-2673" }, { "url": "https://github.com/openssl/openssl/commit/2157c9d81f7b0bd7dfa25b960e928ec28e8dd63f" }, { "url": "https://github.com/openssl/openssl/commit/85977e013f32ceb96aa034c0e741adddc1a05e34" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2673" }, { "url": "https://openssl-library.org/news/secadv/20260313.txt" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-2673" } ], "published": "2026-03-13T19:54:34+00:00", "updated": "2026-03-17T18:16:15+00:00", "affects": [ { "ref": "pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.0.7-8.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.0.7-8.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1", "versions": [ { "version": "1:3.5.1-7.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl-fips-provider-so@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl-fips-provider@3.0.7-8.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl-libs@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/openssl@3.5.1-7.el9_7?arch=x86_64&distro=redhat-9.7&epoch=1" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-27135", "ratings": [ { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 617 ], "description": "nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27135" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/20/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27135" }, { "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1" }, { "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135" } ], "published": "2026-03-18T18:16:26+00:00", "updated": "2026-03-23T17:51:17+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "1.43.0-6.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libnghttp2@1.43.0-6.el9?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-27171", "ratings": [ { "source": { "name": "azure" }, "severity": "low" }, { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 1284 ], "description": "zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "url": "https://7asecurity.com/blog/2026/02/zlib-7asecurity-audit/" }, { "url": "https://7asecurity.com/reports/pentest-report-zlib-RC1.1.pdf" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27171" }, { "url": "https://github.com/madler/zlib/issues/904" }, { "url": "https://github.com/madler/zlib/releases/tag/v1.3.2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27171" }, { "url": "https://ostif.org/zlib-audit-complete/" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27171" } ], "published": "2026-02-18T04:16:01+00:00", "updated": "2026-03-25T21:27:04+00:00", "affects": [ { "ref": "pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "1.2.11-40.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/zlib@1.2.11-40.el9?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-29111", "ratings": [ { "source": { "name": "redhat" }, "score": 7.8, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "cwes": [ 269 ], "description": "systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data. On version v249 and older the effect is not an assert, but stack overwriting, with the attacker controlled content. From version v250 and newer this is not possible as the safety check causes an assert instead. This IPC call was added in v239, so versions older than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11 contain patches. No known workarounds are available.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-29111" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-29111" }, { "url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a" }, { "url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6" }, { "url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412" }, { "url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd" }, { "url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f" }, { "url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f" }, { "url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69" }, { "url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6" }, { "url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c" }, { "url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8" }, { "url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-29111" } ], "published": "2026-03-23T22:16:26+00:00", "updated": "2026-03-24T15:53:48+00:00", "affects": [ { "ref": "pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-32284", "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32284" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32284" }, { "url": "https://github.com/golang/vulndb/issues/4513" }, { "url": "https://github.com/shamaton/msgpack" }, { "url": "https://github.com/shamaton/msgpack/issues/59" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32284" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4513" }, { "url": "https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32284" } ], "published": "2026-03-26T20:16:12+00:00", "updated": "2026-03-30T15:16:27+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "21.3.1-1.el9", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip-wheel@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-pip@21.3.1-1.el9?arch=noarch&distro=redhat-9.7" } ] }, { "id": "CVE-2026-32776", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 6.2, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32776" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32776" }, { "url": "https://github.com/libexpat/libexpat/pull/1158" }, { "url": "https://github.com/libexpat/libexpat/pull/1159" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32776" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32776" } ], "published": "2026-03-16T14:19:44+00:00", "updated": "2026-03-17T15:52:09+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.5.0-5.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-32777", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "cwes": [ 835 ], "description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32777" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32777" }, { "url": "https://github.com/libexpat/libexpat/issues/1161" }, { "url": "https://github.com/libexpat/libexpat/pull/1159" }, { "url": "https://github.com/libexpat/libexpat/pull/1162" }, { "url": "https://issues.oss-fuzz.com/issues/486993411" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32777" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32777" } ], "published": "2026-03-16T14:19:44+00:00", "updated": "2026-03-17T15:52:34+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.5.0-5.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-32778", "ratings": [ { "source": { "name": "nvd" }, "score": 5.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 5.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 476 ], "description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-32778" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-32778" }, { "url": "https://github.com/libexpat/libexpat/pull/1159" }, { "url": "https://github.com/libexpat/libexpat/pull/1163" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32778" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-32778" } ], "published": "2026-03-16T14:19:44+00:00", "updated": "2026-03-17T15:52:53+00:00", "affects": [ { "ref": "pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.5.0-5.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/expat@2.5.0-5.el9_7.1?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-33056", "ratings": [ { "source": { "name": "ghsa" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 4.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "cwes": [ 61 ], "description": "tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory \u2014 and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33056" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33056" }, { "url": "https://github.com/alexcrichton/tar-rs" }, { "url": "https://github.com/alexcrichton/tar-rs/commit/17b1fd84e632071cb8eef9d3709bf347bd266446" }, { "url": "https://github.com/alexcrichton/tar-rs/security/advisories/GHSA-j4xf-2g29-59ph" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33056" }, { "url": "https://rustsec.org/advisories/RUSTSEC-2026-0067.html" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33056" } ], "published": "2026-03-20T08:16:11+00:00", "updated": "2026-03-24T16:17:11+00:00", "affects": [ { "ref": "pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.34-9.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/tar@1.34-9.el9_7?arch=x86_64&distro=redhat-9.7&epoch=2" } ] }, { "id": "CVE-2026-33416", "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 416 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, `png_set_tRNS` and `png_set_PLTE` each alias a heap-allocated buffer between `png_struct` and `png_info`, sharing a single allocation across two structs with independent lifetimes. The `trans_alpha` aliasing has been present since at least libpng 1.0, and the `palette` aliasing since at least 1.2.1. Both affect all prior release lines `png_set_tRNS` sets `png_ptr->trans_alpha = info_ptr->trans_alpha` (256-byte buffer) and `png_set_PLTE` sets `info_ptr->palette = png_ptr->palette` (768-byte buffer). In both cases, calling `png_free_data` (with `PNG_FREE_TRNS` or `PNG_FREE_PLTE`) frees the buffer through `info_ptr` while the corresponding `png_ptr` pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to `png_set_tRNS` or `png_set_PLTE` has the same effect, because both functions call `png_free_data` internally before reallocating the `info_ptr` buffer. Version 1.6.56 fixes the issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33416" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33416" }, { "url": "https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820eb" }, { "url": "https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d90667" }, { "url": "https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a25" }, { "url": "https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012ec1" }, { "url": "https://github.com/pnggroup/libpng/pull/824" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33416" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33416" } ], "published": "2026-03-26T17:16:38+00:00", "updated": "2026-03-30T13:26:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ] }, { "id": "CVE-2026-33636", "ratings": [ { "source": { "name": "redhat" }, "score": 7.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H" } ], "cwes": [ 125, 787 ], "description": "LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33636" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33636" }, { "url": "https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb40869" }, { "url": "https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339c3" }, { "url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33636" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33636" } ], "published": "2026-03-26T17:16:41+00:00", "updated": "2026-03-30T13:26:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2", "versions": [ { "version": "2:1.6.37-12.el9_7.1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libpng@1.6.37-12.el9_7.1?arch=x86_64&distro=redhat-9.7&epoch=2" } ] }, { "id": "CVE-2026-34085", "ratings": [ { "source": { "name": "nvd" }, "score": 7.8, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "source": { "name": "redhat" }, "score": 6.6, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H" } ], "cwes": [ 193 ], "description": "fontconfig before 2.17.1 has an off-by-one error in allocation during sfnt capability handling, leading to a one-byte out-of-bounds write, and potentially a crash or code execution. This is in FcFontCapabilities in fcfreetype.c.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-34085" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-34085" }, { "url": "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/commit/b9bec06d73340f1b5727302d13ac3df307b7febc" }, { "url": "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/merge_requests/446" }, { "url": "https://gitlab.freedesktop.org/fontconfig/fontconfig/-/work_items/481" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34085" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-34085" } ], "published": "2026-03-25T17:17:09+00:00", "updated": "2026-03-27T21:39:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.14.0-2.el9_1", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/fontconfig@2.14.0-2.el9_1?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-3479", "ratings": [ { "source": { "name": "redhat" }, "score": 3.3, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 22 ], "description": "pkgutil.get_data() did not validate the resource argument as documented, allowing path traversals.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3479" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3479" }, { "url": "https://github.com/python/cpython/commit/bcdf231946b1da8bdfbab4c05539bb0cc964a1c7" }, { "url": "https://github.com/python/cpython/issues/146121" }, { "url": "https://github.com/python/cpython/pull/146122" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/WYLLVQOOCKGK73JM7Z7ZSNOJC4N7BAWY/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3479" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3479" } ], "published": "2026-03-18T19:16:06+00:00", "updated": "2026-03-19T18:16:22+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-3644", "ratings": [ { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "cwes": [ 20, 116 ], "description": "The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update(), |= operator, and unpickling paths were not patched, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3644" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3644" }, { "url": "https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4" }, { "url": "https://github.com/python/cpython/commit/62ceb396fcbe69da1ded3702de586f4072b590dd" }, { "url": "https://github.com/python/cpython/commit/d16ecc6c3626f0e2cc8f08c309c83934e8a979dd" }, { "url": "https://github.com/python/cpython/issues/145599" }, { "url": "https://github.com/python/cpython/pull/145600" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3644" } ], "published": "2026-03-16T18:16:09+00:00", "updated": "2026-03-17T14:20:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-3783", "ratings": [ { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 5.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 522 ], "description": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a redirect to a second URL, curl could leak that token to the second\nhostname under some circumstances.\n\nIf the hostname that the first request is redirected to has information in the\nused .netrc file, with either of the `machine` or `default` keywords, curl\nwould pass on the bearer token set for the first host also to the second one.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3783" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/11/2" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3783" }, { "url": "https://curl.se/docs/CVE-2026-3783.html" }, { "url": "https://curl.se/docs/CVE-2026-3783.json" }, { "url": "https://hackerone.com/reports/3583983" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3783" }, { "url": "https://ubuntu.com/security/notices/USN-8084-1" }, { "url": "https://ubuntu.com/security/notices/USN-8099-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3783" } ], "published": "2026-03-11T11:16:00+00:00", "updated": "2026-03-12T14:10:37+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-3784", "ratings": [ { "source": { "name": "photon" }, "severity": "medium" }, { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "source": { "name": "ubuntu" }, "severity": "low" } ], "cwes": [ 305 ], "description": "curl would wrongly reuse an existing HTTP proxy connection doing CONNECT to a\nserver, even if the new request uses different credentials for the HTTP proxy.\nThe proper behavior is to create or use a separate connection.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3784" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/11/3" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3784" }, { "url": "https://curl.se/docs/CVE-2026-3784.html" }, { "url": "https://curl.se/docs/CVE-2026-3784.json" }, { "url": "https://hackerone.com/reports/3584903" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3784" }, { "url": "https://ubuntu.com/security/notices/USN-8084-1" }, { "url": "https://ubuntu.com/security/notices/USN-8099-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3784" } ], "published": "2026-03-11T11:16:00+00:00", "updated": "2026-03-12T14:09:50+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-3805", "ratings": [ { "source": { "name": "photon" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 6.3, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L" }, { "source": { "name": "ubuntu" }, "severity": "medium" } ], "cwes": [ 416 ], "description": "When doing a second SMB request to the same host again, curl would wrongly use\na data pointer pointing into already freed memory.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-3805" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/11/4" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-3805" }, { "url": "https://curl.se/docs/CVE-2026-3805.html" }, { "url": "https://curl.se/docs/CVE-2026-3805.json" }, { "url": "https://hackerone.com/reports/3591944" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3805" }, { "url": "https://ubuntu.com/security/notices/USN-8084-1" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-3805" } ], "published": "2026-03-11T11:16:00+00:00", "updated": "2026-03-12T14:08:56+00:00", "affects": [ { "ref": "pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "7.76.1-35.el9_7.3", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/curl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libcurl-minimal@7.76.1-35.el9_7.3?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-4105", "ratings": [ { "source": { "name": "redhat" }, "score": 6.7, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H" } ], "cwes": [ 284 ], "description": "A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4105" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4105" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447262" }, { "url": "https://github.com/systemd/systemd/security/advisories/GHSA-4h6x-r8vx-3862" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4105" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4105" } ], "published": "2026-03-13T19:55:13+00:00", "updated": "2026-03-16T14:53:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "252-55.el9_7.7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd-libs@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd-pam@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd-rpm-macros@252-55.el9_7.7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/systemd@252-55.el9_7.7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-4111", "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "rocky" }, "severity": "high" } ], "cwes": [ 835 ], "description": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.", "recommendation": "Upgrade libarchive to version 3.5.3-7.el9_7", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4111" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5063" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5080" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4111" }, { "url": "https://bugzilla.redhat.com/2446453" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453" }, { "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4111" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-5080.html" }, { "url": "https://errata.rockylinux.org/RLSA-2026:5080" }, { "url": "https://github.com/libarchive/libarchive/pull/2877" }, { "url": "https://linux.oracle.com/cve/CVE-2026-4111.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-5080.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4111" } ], "published": "2026-03-13T19:55:13+00:00", "updated": "2026-03-19T12:16:18+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-4224", "ratings": [ { "source": { "name": "redhat" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 674 ], "description": "When an Expat parser with a registered ElementDeclHandler parses an inline\ndocument type definition containing a deeply nested content model a C stack\noverflow occurs.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4224" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/16/4" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4224" }, { "url": "https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a" }, { "url": "https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3" }, { "url": "https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768" }, { "url": "https://github.com/python/cpython/issues/145986" }, { "url": "https://github.com/python/cpython/pull/145987" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4224" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4224" } ], "published": "2026-03-16T18:16:10+00:00", "updated": "2026-03-17T14:20:01+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2026-4424", "ratings": [ { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "cwes": [ 125 ], "description": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4424" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4424" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006" }, { "url": "https://github.com/libarchive/libarchive/pull/2898" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4424" } ], "published": "2026-03-19T15:16:28+00:00", "updated": "2026-03-20T13:39:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-4426", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" } ], "cwes": [ 1335 ], "description": "A flaw was found in libarchive. An Undefined Behavior vulnerability exists in the zisofs decompression logic, caused by improper validation of a field (`pz_log2_bs`) read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file. This can lead to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4426" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4426" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449010" }, { "url": "https://github.com/libarchive/libarchive/pull/2897" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4426" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4426" } ], "published": "2026-03-19T15:16:28+00:00", "updated": "2026-03-20T13:39:46+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-4437", "ratings": [ { "source": { "name": "redhat" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" } ], "cwes": [ 125 ], "description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4437" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4437" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34014" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4437" } ], "published": "2026-03-20T20:16:49+00:00", "updated": "2026-03-23T16:16:51+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.34-231.el9_7.10", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.34-231.el9_7.10", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.34-231.el9_7.10", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-4438", "ratings": [ { "source": { "name": "redhat" }, "score": 4, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 20, 88 ], "description": "Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4438" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4438" }, { "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34015" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4438" } ], "published": "2026-03-20T20:16:49+00:00", "updated": "2026-03-23T15:16:35+00:00", "affects": [ { "ref": "pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.34-231.el9_7.10", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.34-231.el9_7.10", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "2.34-231.el9_7.10", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glibc-common@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glibc-minimal-langpack@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/glibc@2.34-231.el9_7.10?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-4519", "ratings": [ { "source": { "name": "cbl-mariner" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.1, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L" } ], "cwes": [ 20 ], "description": "The webbrowser.open() API would accept leading dashes in the URL which \ncould be handled as command line options for certain web browsers. New \nbehavior rejects leading dashes. Users are recommended to sanitize URLs \nprior to passing to webbrowser.open().", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-4519" }, { "url": "http://www.openwall.com/lists/oss-security/2026/03/20/1" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-4519" }, { "url": "https://github.com/python/cpython/commit/43fe06b96f6a6cf5cfd5bdab20b8649374956866" }, { "url": "https://github.com/python/cpython/commit/82a24a4442312bdcfc4c799885e8b3e00990f02b" }, { "url": "https://github.com/python/cpython/commit/9669a912a0e329c094e992204d6bdb8787024d76" }, { "url": "https://github.com/python/cpython/commit/ad4d5ba32af4d80b0dfa2ba9d8203bfb219e60a5" }, { "url": "https://github.com/python/cpython/commit/cbba6119391112aba9c5aebf7b94aea447922c48" }, { "url": "https://github.com/python/cpython/commit/ceac1efc66516ac387eef2c9a0ce671895b44f03" }, { "url": "https://github.com/python/cpython/issues/143930" }, { "url": "https://github.com/python/cpython/pull/143931" }, { "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-4519" } ], "published": "2026-03-20T15:16:24+00:00", "updated": "2026-03-25T18:16:33+00:00", "affects": [ { "ref": "pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.9.25-3.el9_7", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python-unversioned-command@3.9.25-3.el9_7?arch=noarch&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3-libs@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/python3@3.9.25-3.el9_7?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "CVE-2026-5121", "ratings": [ { "source": { "name": "redhat" }, "severity": "medium" } ], "description": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-5121" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-5121" }, { "url": "https://github.com/libarchive/libarchive/pull/2934" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-5121" } ], "published": "2026-03-30T08:16:18+00:00", "updated": "2026-03-30T13:26:07+00:00", "affects": [ { "ref": "pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7", "versions": [ { "version": "3.5.3-6.el9_6", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:09c0ff05-e59c-4664-9bbf-b56795c97575/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:rpm/redhat/libarchive@3.5.3-6.el9_6?arch=x86_64&distro=redhat-9.7" } ] }, { "id": "GHSA-72hv-8253-57qq", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [], "description": "### Summary\nThe non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS).\n\nThe standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy.\n\n### Details\nThe root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation.\n\n- The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks.\n- After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`.\n- The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed.\n- Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path.\n\n### PoC\nThe following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000.\n\n```java\npackage tools.jackson.core.unittest.dos;\n\nimport java.nio.charset.StandardCharsets;\n\nimport org.junit.jupiter.api.Test;\n\nimport tools.jackson.core.*;\nimport tools.jackson.core.exc.StreamConstraintsException;\nimport tools.jackson.core.json.JsonFactory;\nimport tools.jackson.core.json.async.NonBlockingByteArrayJsonParser;\n\nimport static org.junit.jupiter.api.Assertions.*;\n\n/**\n * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers\n *\n * Authors: sprabhav7, rohan-repos\n * \n * maxNumberLength default = 1000 characters (digits).\n * A number with more than 1000 digits should be rejected by any parser.\n *\n * BUG: The async parser never calls resetInt()/resetFloat() which is where\n * validateIntegerLength()/validateFPLength() lives. Instead it calls\n * _valueComplete() which skips all number length validation.\n *\n * CWE-770: Allocation of Resources Without Limits or Throttling\n */\nclass AsyncParserNumberLengthBypassTest {\n\n private static final int MAX_NUMBER_LENGTH = 1000;\n private static final int TEST_NUMBER_LENGTH = 5000;\n\n private final JsonFactory factory = new JsonFactory();\n\n // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength\n @Test\n void syncParserRejectsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\t\t\n\t\t// Output to console\n System.out.println(\"[SYNC] Parsing \" + TEST_NUMBER_LENGTH + \"-digit number (limit: \" + MAX_NUMBER_LENGTH + \")\");\n try {\n try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n System.out.println(\"[SYNC] Accepted number with \" + p.getText().length() + \" digits \u2014 UNEXPECTED\");\n }\n }\n }\n fail(\"Sync parser must reject a \" + TEST_NUMBER_LENGTH + \"-digit number\");\n } catch (StreamConstraintsException e) {\n System.out.println(\"[SYNC] Rejected with StreamConstraintsException: \" + e.getMessage());\n }\n }\n\n // VULNERABILITY: Async parser accepts the SAME number that sync rejects\n @Test\n void asyncParserAcceptsLongNumber() throws Exception {\n byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH);\n\n NonBlockingByteArrayJsonParser p =\n (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty());\n p.feedInput(payload, 0, payload.length);\n p.endOfInput();\n\n boolean foundNumber = false;\n try {\n while (p.nextToken() != null) {\n if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) {\n foundNumber = true;\n String numberText = p.getText();\n assertEquals(TEST_NUMBER_LENGTH, numberText.length(),\n \"Async parser silently accepted all \" + TEST_NUMBER_LENGTH + \" digits\");\n }\n }\n // Output to console\n System.out.println(\"[ASYNC INT] Accepted number with \" + TEST_NUMBER_LENGTH + \" digits \u2014 BUG CONFIRMED\");\n assertTrue(foundNumber, \"Parser should have produced a VALUE_NUMBER_INT token\");\n } catch (StreamConstraintsException e) {\n fail(\"Bug is fixed \u2014 async parser now correctly rejects long numbers: \" + e.getMessage());\n }\n p.close();\n }\n\n private byte[] buildPayloadWithLongInteger(int numDigits) {\n StringBuilder sb = new StringBuilder(numDigits + 10);\n sb.append(\"{\\\"v\\\":\");\n for (int i = 0; i < numDigits; i++) {\n sb.append((char) ('1' + (i % 9)));\n }\n sb.append('}');\n return sb.toString().getBytes(StandardCharsets.UTF_8);\n }\n}\n\n```\n\n\n### Impact\nA malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause:\n1. **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`.\n2. **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS.\n\n### Suggested Remediation\n\nThe async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers.\n\n**NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)", "recommendation": "Upgrade com.fasterxml.jackson.core:jackson-core to version 2.18.6, 2.21.1, 3.1.0", "advisories": [ { "url": "https://github.com/advisories/GHSA-72hv-8253-57qq" }, { "url": "https://github.com/FasterXML/jackson-core" }, { "url": "https://github.com/FasterXML/jackson-core/commit/b0c428e6f993e1b5ece5c1c3cb2523e887cd52cf" }, { "url": "https://github.com/FasterXML/jackson-core/pull/1555" }, { "url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-72hv-8253-57qq" } ], "published": "2026-02-28T02:01:05+00:00", "updated": "2026-03-27T14:26:32+00:00", "affects": [ { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0", "versions": [ { "version": "2.16.0", "status": "affected" } ] }, { "ref": "pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2", "versions": [ { "version": "2.16.2", "status": "affected" } ] }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#2bdc252f-aa4f-439c-9ae5-4eed928b33a3" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2" }, { "ref": "urn:cdx:06729509-e912-4a9e-8620-c6789f6ed513/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#a0c6b3b7-c037-4745-9856-039e37f0d582" }, { "ref": "urn:cdx:995976ce-4238-443a-aa96-ceab84478e30/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#4883afa5-2c4d-4244-9486-b48f39edb11e" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#34d4f228-8cb7-41f3-a9ff-0ce35ab4ae2d" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#98947236-ee04-4a0f-bebe-1c786ce254f1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:12a02d4d-35e5-455a-9c3e-781602fd69ae/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03c96474-20d3-4aa3-b95d-b846b5e5ffd7" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00eb3ece-b9ae-423f-9cf6-d62e2c476d28" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.0" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#16da3dfb-2390-450c-80d6-bb1ff46d43fb" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#1252357b-0176-4b5c-89a0-0135c611488c" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/com.fasterxml.jackson.core/jackson-core@2.16.2" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#32d655e4-56a7-43f2-88b7-3ede9e41eb8b" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#25dbd9e1-7583-4ded-9186-c1e037fb753d" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#2da67c3a-92c8-4eea-a256-3245a3eec43d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#29e40804-14ce-4d65-947e-ee8dc92a7a9b" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#217e4e50-e727-4c87-9831-3b8eec826bf6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#070ecadf-0657-4eda-88c2-c879f792fd81" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0d1b316a-c89d-4e05-a7a1-995defba03af" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#229cca45-54c7-4fe2-a63b-8f051c152d1e" } ], "analysis": { "state": "not_affected", "justification": "", "response": [ "update" ], "detail": null } }, { "id": "CVE-2025-11143", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" }, { "source": { "name": "nvd" }, "score": 6.5, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N" } ], "cwes": [ 20 ], "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs.\u00a0Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response.\u00a0At the very least, differential parsing may divulge implementation details.", "recommendation": "Upgrade org.eclipse.jetty:jetty-http to version 12.0.31, 12.1.5", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-11143" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-11143" }, { "url": "https://github.com/jetty/jetty.project" }, { "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh" }, { "url": "https://github.com/user-attachments/files/22222625/Java.Eclipse.Jetty.Report_.Incorrect.Parsing.Priority.of.the.IPv6.Hostname.Delimeter.pdf" }, { "url": "https://github.com/user-attachments/files/22222626/Java.Eclipse.Jetty.Report_.The.Parsing.Priority.of.the.Delimiter.pdf" }, { "url": "https://github.com/user-attachments/files/22222627/Java.Eclipse.Jetty.Report_.Parsing.Difference.Due.to.Deformed.Scheme.pdf" }, { "url": "https://github.com/user-attachments/files/22222630/Java.Eclipse.Jetty.Report_.Improper.IPv4-mapped.IPv6.Parsing.pdf" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11143" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-11143" } ], "published": "2026-03-05T10:15:54+00:00", "updated": "2026-03-06T20:30:58+00:00", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-http@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#26a11570-6a4d-4c2d-b25c-2b1a0251fa80" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#5dcbf99c-34a9-454f-97ae-97f6b59d17f7" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#3646b7c1-4cfc-490f-a7c2-f7b99a3c7bda" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#1ab4c907-e2c5-4c5d-937c-9d6273c552cc" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0f8695e8-868c-4cdb-985c-95d9417048fe" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#18ec5743-0032-4399-9702-5c50bc2afe29" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#13df389e-89d6-4f91-9336-9b069c976d04" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#ae5f2ee0-9f4b-4c7f-9574-5c775b54ae98" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#280b0484-102e-4a68-ac01-d5513807a760" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-http@12.0.25" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#301aa7cd-4bfe-42cb-be7f-b1866c421bbb" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2f6a2508-f4fd-447b-974d-f3ccd400c700" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#03e4dbed-578a-4a51-83f4-b9b93bd547fe" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0f9dbaaf-fee5-44ed-9281-2d376f5955a2" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#02a5e96c-d42f-4c66-a664-08cebe5c2cb1" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "There is no confusion between the URI parsing Confluent\u2019s use cases. " } }, { "id": "CVE-2025-67030", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 8.3, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L" } ], "cwes": [ 22 ], "description": "Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code", "recommendation": "Upgrade org.codehaus.plexus:plexus-utils to version 4.0.3", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2025-67030" }, { "url": "https://access.redhat.com/security/cve/CVE-2025-67030" }, { "url": "https://gist.github.com/weaver4VD/3216dac645220f8c9b488362f61241ec" }, { "url": "https://github.com/codehaus-plexus/plexus-utils" }, { "url": "https://github.com/codehaus-plexus/plexus-utils/commit/6d780b3378829318ba5c2d29547e0012d5b29642" }, { "url": "https://github.com/codehaus-plexus/plexus-utils/issues/294" }, { "url": "https://github.com/codehaus-plexus/plexus-utils/pull/295" }, { "url": "https://github.com/codehaus-plexus/plexus-utils/pull/296" }, { "url": "https://github.com/codehaus-plexus/plexus-utils/releases/tag/plexus-utils-4.0.3" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67030" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2025-67030" } ], "published": "2026-03-25T18:16:25+00:00", "updated": "2026-03-27T20:16:24+00:00", "affects": [ { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1", "versions": [ { "version": "3.5.1", "status": "affected" } ] }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#453e5d99-9d59-4c46-9e0d-e99de0cb225c" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#38d9e775-d750-411c-9eb0-ce01f69cc51a" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#5a6aa02b-3e34-48c8-be2c-c434d152bec9" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#5f0f4121-802f-485e-b7a1-f57a9f01f0ed" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#264b9ead-d1ea-4ff9-bd4c-5b9c477314ae" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#19156825-02fb-4d32-9560-715ff9448063" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.codehaus.plexus/plexus-utils@3.5.1" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#0d95c15d-f722-4c10-b914-0f36bc901a97" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#45859d2f-582b-4138-b128-2e8c9b8a3d67" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0a09d67d-75bc-46c0-84e0-4813fed08040" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#0217ab71-4004-4eb6-8125-13486a2aaf02" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#4515946c-d74b-4bb5-864b-b82764a543ab" } ] }, { "id": "CVE-2026-1605", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "cwes": [ 400, 401 ], "description": "In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.", "recommendation": "Upgrade org.eclipse.jetty:jetty-server to version 12.1.6, 12.0.32", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-1605" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-1605" }, { "url": "https://github.com/jetty/jetty.project" }, { "url": "https://github.com/jetty/jetty.project/issues/14260" }, { "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f" }, { "url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/79" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1605" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-1605" } ], "published": "2026-03-05T10:15:56+00:00", "updated": "2026-03-06T20:16:49+00:00", "affects": [ { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "pkg:maven/org.eclipse.jetty/jetty-server@12.0.25", "versions": [ { "version": "12.0.25", "status": "affected" } ] }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#3d0af8da-5cc4-4a2c-9dd7-a2cd3e5ecd01" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:34cb5636-9627-47bc-abc8-fa9f40a7059a/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:454389ff-da2e-42ee-b7b0-005101da7d4d/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#4ba9e208-fbe0-4ef7-b02b-7f33092777a0" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:2cf170ed-13d7-40f5-8d9f-63fce06a1f92/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:f56809f6-6ed8-449f-856d-a0e5fe1ff97b/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#217469df-25db-412a-802b-5bf94ec1f168" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#01d5b398-0d06-43d0-8734-4f10cc8ab4e1" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#03be837e-8d00-4cbf-9f24-4de057b33684" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#06dd748f-cd4d-4b71-b1d0-628280ebb1b0" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:1e0b33a3-abc1-42e8-a3d5-fc8868daab0f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#c1824af2-14b5-4134-90e6-5f21d4369ce5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#2414e5e0-2b1f-4e54-bd0b-9548dee5b9a5" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0b764783-bf35-420d-aca1-5f184281308b" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/org.eclipse.jetty/jetty-server@12.0.25" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#19682514-ca24-4d49-b99f-6c02eef73d5a" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#2d66cd62-d68d-4280-a0fd-167a844a8d40" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#4b705352-ae1b-4f77-aa1c-db8786f9a920" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#033a273f-5d52-40aa-afa9-db1be11589c5" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#0f28ad57-b908-4ca5-8360-39b45a6e44e0" } ], "analysis": { "state": "not_affected", "justification": "code_not_reachable", "response": [ "update" ], "detail": "The gzip handler is used uniformly, and the prerequisites for the exploitation are not met." } }, { "id": "CVE-2026-33870", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [ { "source": { "name": "ghsa" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "cwes": [ 444 ], "description": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.", "recommendation": "Upgrade io.netty:netty-codec-http to version 4.1.132.Final, 4.2.10.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-33870" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-pwqr-wmgm-9rr8" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870" }, { "url": "https://w4ke.info/2025/06/18/funky-chunks.html" }, { "url": "https://w4ke.info/2025/10/29/funky-chunks-2.html" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-33870" }, { "url": "https://www.rfc-editor.org/rfc/rfc9110" } ], "published": "2026-03-27T20:16:34+00:00", "updated": "2026-03-30T13:26:29+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#004c1ec2-70bf-4baa-9c87-4928f692b170" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#27ae1d13-3071-410d-8383-31e5c29f6b21" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#93fc95ee-f745-4806-b875-831256769737" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#3ecaeea7-2162-4555-9c5b-c6e38607725c" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#04afaa45-5893-4fe8-aa4f-fada2062243a" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#84507cb5-73c1-47b0-a21e-db4e1f425a98" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#85d7dfb9-f6c9-4ada-9dd5-7d47c24dfa56" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#0bd0a32f-7135-4823-8ea6-bdf113030b12" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#00421db3-ab9e-4da4-9518-c2d5061fb11b" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http@4.1.130.Final" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#13dcf64e-03c3-4603-9b3f-b8df55efbec9" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#078b237a-34c6-4b62-862a-3821e52aeefd" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#47814a28-d02c-4ff2-a9fb-3dee4e16a532" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#01b41b49-6e22-40a3-b458-cea9f6e3032d" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#43e99876-0d07-492b-9b24-68de1a0a40af" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#031908dc-0575-49e4-9cec-d573cb41b3c6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#1c97ae65-c049-4831-90bd-7237edcd6c64" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#241a9c44-abe2-41d6-820f-64953173c35e" } ] }, { "id": "CVE-2026-33871", "source": { "name": "ghsa", "url": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Amaven" }, "ratings": [], "cwes": [ 770 ], "description": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.", "recommendation": "Upgrade io.netty:netty-codec-http2 to version 4.1.132.Final, 4.2.11.Final", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "url": "https://github.com/netty/netty" }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871" } ], "published": "2026-03-27T20:16:34+00:00", "updated": "2026-03-30T13:26:29+00:00", "affects": [ { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "pkg:maven/io.netty/netty-codec-http2@4.1.130.Final", "versions": [ { "version": "4.1.130.Final", "status": "affected" } ] }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:b1a37af5-4866-47b3-a61f-43df5e28d834/1#27a9d486-bcb7-45df-8382-0d3872c15689" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7b3fa49c-a99e-47a3-aff9-748c9a92242f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:dfffaf7a-474d-4fd9-b94d-688046329f8b/1#d70c4650-3ab2-4810-8226-c36bdda4553c" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7d94911b-e102-4220-a44d-022315691988/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:13d5378d-c8a6-4e56-af09-ee23af9ba567/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:22683389-5361-4983-aa9b-ee2e92be16e2/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7c414493-8722-4ee7-b3ef-ffe37d313fc9/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:590e90d4-0276-470f-a47c-de61b8891143/1#0821d301-4036-4263-80d5-4e39b981dbd4" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:d4a46978-a43a-41e4-ac1d-6c32a8e9e7a8/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:7f2f6460-3664-49bc-a911-53f2f67be3ff/1#36a413ca-6f37-4274-ab38-fcf996274958" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:1af6e9fb-5d91-4695-ada5-ebf2e3d687bd/1#1e884e3a-ffeb-45e1-ac70-231177b7979a" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:a1967bf9-fe96-417f-9197-0062b678ef2e/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:b61df081-6174-494f-942f-35f66d85e8e5/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:04b30b4b-20c9-4c06-a5b2-93fbf5f53139/1#0d6e7823-23bf-43fe-86be-1338942f7d31" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:9d2325fb-0eeb-4e55-ace3-66873341262f/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:229ce15b-9c7c-48df-8ceb-585b78c0013d/1#db780232-390f-40c1-be75-63ad38521182" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:1cac6e3c-3755-4aff-9bb3-a0f9660bfa06/1#1ea9402f-0524-4717-9d79-0bb96f9539e7" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:35b0b52d-0a0f-46ce-83cd-b9880088d124/1#0eef1b29-771c-49d9-b11c-1a07612c12fa" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:28dbf830-f969-48d4-bd27-62596fba268d/1#03f8f316-58df-4aac-a24f-3972bbdbc5f6" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" }, { "ref": "urn:cdx:62758036-9a94-4f3b-9410-d880dfb4b67d/1#pkg:maven/io.netty/netty-codec-http2@4.1.130.Final" } ] }, { "id": "CVE-2026-25679", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "alma" }, "severity": "high" }, { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "azure" }, "severity": "high" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "oracle-oval" }, "severity": "high" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.", "recommendation": "Upgrade stdlib to version 1.25.8, 1.26.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-25679" }, { "url": "https://access.redhat.com/errata/RHSA-2026:5942" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-25679" }, { "url": "https://bugzilla.redhat.com/2434433" }, { "url": "https://bugzilla.redhat.com/2445356" }, { "url": "https://errata.almalinux.org/9/ALSA-2026-5942.html" }, { "url": "https://go.dev/cl/752180" }, { "url": "https://go.dev/issue/77578" }, { "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk" }, { "url": "https://linux.oracle.com/cve/CVE-2026-25679.html" }, { "url": "https://linux.oracle.com/errata/ELSA-2026-5942.html" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4601" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679" } ], "published": "2026-03-06T22:16:00+00:00", "updated": "2026-03-10T18:18:37+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-27137", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 7.5, "severity": "high", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "description": "When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.", "recommendation": "Upgrade stdlib to version 1.26.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27137" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27137" }, { "url": "https://go.dev/cl/752182" }, { "url": "https://go.dev/issue/77952" }, { "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4599" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27137" } ], "published": "2026-03-06T22:16:00+00:00", "updated": "2026-03-10T18:18:44+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-27138", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "azure" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 5.9, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" }, { "source": { "name": "redhat" }, "score": 3.7, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "description": "Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.", "recommendation": "Upgrade stdlib to version 1.26.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27138" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27138" }, { "url": "https://go.dev/cl/752183" }, { "url": "https://go.dev/issue/77953" }, { "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27138" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4600" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27138" } ], "published": "2026-03-06T22:16:00+00:00", "updated": "2026-03-10T18:18:44+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-27139", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" }, { "source": { "name": "redhat" }, "score": 2.5, "severity": "low", "method": "CVSSv31", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N" } ], "description": "On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.", "recommendation": "Upgrade stdlib to version 1.25.8, 1.26.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27139" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27139" }, { "url": "https://go.dev/cl/749480" }, { "url": "https://go.dev/issue/77827" }, { "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27139" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4602" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27139" } ], "published": "2026-03-06T22:16:01+00:00", "updated": "2026-03-09T15:15:57+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } }, { "id": "CVE-2026-27142", "source": { "name": "govulndb", "url": "https://pkg.go.dev/vuln/" }, "ratings": [ { "source": { "name": "amazon" }, "severity": "medium" }, { "source": { "name": "bitnami" }, "score": 6.1, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "source": { "name": "redhat" }, "score": 5.4, "severity": "medium", "method": "CVSSv31", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" } ], "description": "Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0.", "recommendation": "Upgrade stdlib to version 1.25.8, 1.26.1", "advisories": [ { "url": "https://avd.aquasec.com/nvd/cve-2026-27142" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-27142" }, { "url": "https://go.dev/cl/752081" }, { "url": "https://go.dev/issue/77954" }, { "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk" }, { "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27142" }, { "url": "https://pkg.go.dev/vuln/GO-2026-4603" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-27142" } ], "published": "2026-03-06T22:16:01+00:00", "updated": "2026-03-16T16:16:13+00:00", "affects": [ { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "pkg:golang/stdlib@v1.26.0", "versions": [ { "version": "v1.26.0", "status": "affected" } ] }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:a5603f1f-138f-4b85-b95b-e3f933942021/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:ef43b027-2159-4df1-87b6-caf0f591a5f4/1#pkg:golang/stdlib@v1.26.0" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" }, { "ref": "urn:cdx:85dea40c-2572-4e8d-99ea-27a5948fc638/1#129e036c-0b4e-4e79-a01f-a5b3a6c37f43" } ], "analysis": { "state": "in_triage", "justification": "", "response": [], "detail": "This CVE is under investigation by Confluent." } } ], "component": [] }