Action not permitted
Modal body text goes here.
CVE-2020-28241
Vulnerability from cvelistv5
Published
2020-11-06 04:43
Modified
2024-08-04 16:33
Severity ?
EPSS score ?
Summary
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3 | Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/maxmind/libmaxminddb/issues/236 | Exploit, Patch, Third Party Advisory | |
cve@mitre.org | https://github.com/maxmind/libmaxminddb/pull/237 | Patch, Third Party Advisory | |
cve@mitre.org | https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html | Mailing List, Third Party Advisory | |
cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/ | ||
cve@mitre.org | https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/ | ||
cve@mitre.org | https://security.gentoo.org/glsa/202011-15 | Third Party Advisory |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T16:33:58.173Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/maxmind/libmaxminddb/issues/236" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/maxmind/libmaxminddb/pull/237" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3" }, { "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2445-1] libmaxminddb security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html" }, { "name": "GLSA-202011-15", "tags": [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202011-15" }, { "name": "FEDORA-2020-1fb1785fa1", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/" }, { "name": "FEDORA-2020-8a8f8b244f", "tags": [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-12-26T02:06:07", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/maxmind/libmaxminddb/issues/236" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/maxmind/libmaxminddb/pull/237" }, { "tags": [ "x_refsource_MISC" ], "url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3" }, { "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2445-1] libmaxminddb security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html" }, { "name": "GLSA-202011-15", "tags": [ "vendor-advisory", "x_refsource_GENTOO" ], "url": "https://security.gentoo.org/glsa/202011-15" }, { "name": "FEDORA-2020-1fb1785fa1", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/" }, { "name": "FEDORA-2020-8a8f8b244f", "tags": [ "vendor-advisory", "x_refsource_FEDORA" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-28241", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/maxmind/libmaxminddb/issues/236", "refsource": "MISC", "url": "https://github.com/maxmind/libmaxminddb/issues/236" }, { "name": "https://github.com/maxmind/libmaxminddb/pull/237", "refsource": "MISC", "url": "https://github.com/maxmind/libmaxminddb/pull/237" }, { "name": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3", "refsource": "MISC", "url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3" }, { "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2445-1] libmaxminddb security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html" }, { "name": "GLSA-202011-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202011-15" }, { "name": "FEDORA-2020-1fb1785fa1", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/" }, { "name": "FEDORA-2020-8a8f8b244f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-28241", "datePublished": "2020-11-06T04:43:12", "dateReserved": "2020-11-06T00:00:00", "dateUpdated": "2024-08-04T16:33:58.173Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-28241\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-11-06T05:15:10.973\",\"lastModified\":\"2023-11-07T03:21:08.773\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.\"},{\"lang\":\"es\",\"value\":\"libmaxminddb versiones anteriores a 1.4.3, presenta una lectura excesiva del b\u00fafer en la regi\u00f3n heap de la memoria en la funci\u00f3n dump_entry_data_list en el archivo maxminddb.c\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:maxmind:libmaxminddb:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.4.3\",\"matchCriteriaId\":\"F4E42653-2CF4-45A4-ACBF-61E211FCDD9E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}],\"references\":[{\"url\":\"https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/maxmind/libmaxminddb/issues/236\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/maxmind/libmaxminddb/pull/237\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://security.gentoo.org/glsa/202011-15\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
wid-sec-w-2024-0521
Vulnerability from csaf_certbund
Published
2024-02-29 23:00
Modified
2024-05-05 22:00
Summary
IBM MQ: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
IBM MQ ist eine Message Oriented Middleware von IBM.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuführen.
Betroffene Betriebssysteme
- Sonstiges
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM MQ ist eine Message Oriented Middleware von IBM.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM MQ ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Sonstiges", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0521 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0521.json" }, { "category": "self", "summary": "WID-SEC-2024-0521 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0521" }, { "category": "external", "summary": "IBM Security Bulletin 7137570 vom 2024-03-12", "url": "https://www.ibm.com/support/pages/node/7137570" }, { "category": "external", "summary": "IBM Security Bulletin 7123135 vom 2024-02-29", "url": "https://www.ibm.com/support/pages/node/7123135" }, { "category": "external", "summary": "IBM Security Bulletin 7123136 vom 2024-02-29", "url": "https://www.ibm.com/support/pages/node/7123136" }, { "category": "external", "summary": "IBM Security Bulletin 7123137 vom 2024-02-29", "url": "https://www.ibm.com/support/pages/node/7123137" }, { "category": "external", "summary": "IBM Security Bulletin 7123138 vom 2024-02-29", "url": "https://www.ibm.com/support/pages/node/7123138" }, { "category": "external", "summary": "IBM Security Bulletin 7123139 vom 2024-02-29", "url": "https://www.ibm.com/support/pages/node/7123139" }, { "category": "external", "summary": "IBM Security Bulletin 7126571 vom 2024-02-29", "url": "https://www.ibm.com/support/pages/node/7126571" }, { "category": "external", "summary": "IBM Security Bulletin 7138007 vom 2024-03-12", "url": "https://www.ibm.com/support/pages/node/7138007" }, { "category": "external", "summary": "IBM Security Bulletin 7129251 vom 2024-03-01", "url": "https://www.ibm.com/support/pages/node/7129251" }, { "category": "external", "summary": "IBM Security Bulletin 7145367 vom 2024-03-27", "url": "https://www.ibm.com/support/pages/node/7145367" }, { "category": "external", "summary": "IBM Security Bulletin 7145780 vom 2024-04-03", "url": "https://www.ibm.com/support/pages/node/7145780" }, { "category": "external", "summary": "IBM Security Bulletin 7146478 vom 2024-04-04", "url": "https://www.ibm.com/support/pages/node/7146478" }, { "category": "external", "summary": "IBM Security Bulletin 7114770 vom 2024-05-01", "url": "https://www.ibm.com/support/pages/node/7114770" }, { "category": "external", "summary": "IBM Security Bulletin 7150144 vom 2024-05-03", "url": "https://www.ibm.com/support/pages/node/7150144" }, { "category": "external", "summary": "IBM Security Bulletin 7150158 vom 2024-05-03", "url": "https://www.ibm.com/support/pages/node/7150158" } ], "source_lang": "en-US", "title": "IBM MQ: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-05T22:00:00.000+00:00", "generator": { "date": "2024-05-06T08:33:17.981+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0521", "initial_release_date": "2024-02-29T23:00:00.000+00:00", "revision_history": [ { "date": "2024-02-29T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-03-03T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-03-04T23:00:00.000+00:00", "number": "3", "summary": "CVE-Zuordnung korrigiert" }, { "date": "2024-03-11T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-03-12T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-03-27T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-04-02T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von IBM und IBM-APAR aufgenommen" }, { "date": "2024-04-04T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-05-01T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-05-02T22:00:00.000+00:00", "number": "10", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2024-05-05T22:00:00.000+00:00", "number": "11", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "11" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c=11.0.0.25", "product": { "name": "IBM App Connect Enterprise \u003c=11.0.0.25", "product_id": "T033537", "product_identification_helper": { "cpe": "cpe:/a:ibm:app_connect_enterprise:11.0.0.25" } } }, { "category": "product_version_range", "name": "\u003c=12.0.11.3", "product": { "name": "IBM App Connect Enterprise \u003c=12.0.11.3", "product_id": "T033842", "product_identification_helper": { "cpe": "cpe:/a:ibm:app_connect_enterprise:12.0.11.3" } } } ], "category": "product_name", "name": "App Connect Enterprise" }, { "category": "product_name", "name": "IBM Business Automation Workflow", "product": { "name": "IBM Business Automation Workflow", "product_id": "T019704", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:-" } } }, { "category": "product_name", "name": "IBM DB2", "product": { "name": "IBM DB2", "product_id": "5104", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c10.5.4", "product": { "name": "IBM DataPower Gateway \u003c10.5.4", "product_id": "T033810", "product_identification_helper": { "cpe": "cpe:/a:ibm:datapower_gateway:10.5.4" } } }, { "category": "product_version_range", "name": "\u003c10.5.0.10", "product": { "name": "IBM DataPower Gateway \u003c10.5.0.10", "product_id": "T033811", "product_identification_helper": { "cpe": "cpe:/a:ibm:datapower_gateway:10.5.0.10" } } }, { "category": "product_version_range", "name": "\u003c10.0.1.18", "product": { "name": "IBM DataPower Gateway \u003c10.0.1.18", "product_id": "T033812", "product_identification_helper": { "cpe": "cpe:/a:ibm:datapower_gateway:10.0.1.18" } } } ], "category": "product_name", "name": "DataPower Gateway" }, { "category": "product_name", "name": "IBM FlashSystem", "product": { "name": "IBM FlashSystem", "product_id": "T025159", "product_identification_helper": { "cpe": "cpe:/a:ibm:flashsystem:-" } } }, { "branches": [ { "category": "product_version", "name": "V10", "product": { "name": "IBM Power Hardware Management Console V10", "product_id": "T023373", "product_identification_helper": { "cpe": "cpe:/a:ibm:hardware_management_console:v10" } } } ], "category": "product_name", "name": "Hardware Management Console" }, { "branches": [ { "category": "product_version_range", "name": "\u003c=10.1.0.3", "product": { "name": "IBM Integration Bus \u003c=10.1.0.3", "product_id": "T033332", "product_identification_helper": { "cpe": "cpe:/a:ibm:integration_bus:10.1.0.3" } } } ], "category": "product_name", "name": "Integration Bus" }, { "branches": [ { "category": "product_version", "name": "9.1 LTS", "product": { "name": "IBM MQ 9.1 LTS", "product_id": "T015789", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:9.1_lts" } } }, { "category": "product_version", "name": "9.0 LTS", "product": { "name": "IBM MQ 9.0 LTS", "product_id": "T015792", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:9.0_lts" } } }, { "category": "product_version", "name": "9.2 LTS", "product": { "name": "IBM MQ 9.2 LTS", "product_id": "T018186", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:9.2_lts" } } }, { "category": "product_version", "name": "9.3 LTS", "product": { "name": "IBM MQ 9.3 LTS", "product_id": "T024689", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:9.3_lts" } } }, { "category": "product_version", "name": "9.3 CD", "product": { "name": "IBM MQ 9.3 CD", "product_id": "T024690", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:9.3_cd" } } }, { "category": "product_version", "name": "Operator v3.1.0 CD", "product": { "name": "IBM MQ Operator v3.1.0 CD", "product_id": "T033202", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:operator_v3.1.0__cd" } } }, { "category": "product_version", "name": "Operator v2.0.19 LTS", "product": { "name": "IBM MQ Operator v2.0.19 LTS", "product_id": "T033203", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:operator_v2.0.19_lts" } } }, { "category": "product_version", "name": "Operator v2.4.8", "product": { "name": "IBM MQ Operator v2.4.8", "product_id": "T033204", "product_identification_helper": { "cpe": "cpe:/a:ibm:mq:operator_v2.4.8" } } } ], "category": "product_name", "name": "MQ" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.5.0 UP8", "product": { "name": "IBM QRadar SIEM \u003c7.5.0 UP8", "product_id": "T033681", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up8" } } } ], "category": "product_name", "name": "QRadar SIEM" }, { "category": "product_name", "name": "IBM SAN Volume Controller", "product": { "name": "IBM SAN Volume Controller", "product_id": "T002782", "product_identification_helper": { "cpe": "cpe:/a:ibm:san_volume_controller:-" } } }, { "category": "product_name", "name": "IBM Storage Scale", "product": { "name": "IBM Storage Scale", "product_id": "T019402", "product_identification_helper": { "cpe": "cpe:/a:ibm:spectrum_scale:-" } } }, { "category": "product_name", "name": "IBM Storwize", "product": { "name": "IBM Storwize", "product_id": "T021621", "product_identification_helper": { "cpe": "cpe:/a:ibm:storwize:-" } } } ], "category": "vendor", "name": "IBM" } ] }, "vulnerabilities": [ { "cve": "CVE-2001-1550", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2001-1550" }, { "cve": "CVE-2002-1711", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2002-1711" }, { "cve": "CVE-2002-1713", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2002-1713" }, { "cve": "CVE-2005-1941", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2005-1941" }, { "cve": "CVE-2020-28241", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2020-28241" }, { "cve": "CVE-2022-48468", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2022-48468" }, { "cve": "CVE-2023-22081", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-22081" }, { "cve": "CVE-2023-39615", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-39615" }, { "cve": "CVE-2023-39976", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-39976" }, { "cve": "CVE-2023-4218", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-4218" }, { "cve": "CVE-2023-44487", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-44487" }, { "cve": "CVE-2023-45287", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-45287" }, { "cve": "CVE-2023-49568", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-49568" }, { "cve": "CVE-2023-5072", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-5072" }, { "cve": "CVE-2023-5676", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-5676" }, { "cve": "CVE-2023-7104", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-7104" }, { "cve": "CVE-2024-0553", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2024-0553" }, { "cve": "CVE-2024-27255", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in verschiedenen Komponenten, unter anderem \"Eclipse\", \"libqb\", \"BasiliX\", \"Libxml2\" oder \"JavaSE\". Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuf\u00fchren, Informationen offenzulegen oder einen Denial of Service Zustand herbeizuf\u00fchren." } ], "product_status": { "known_affected": [ "T033204", "T033842", "T033810", "T024690", "T033202", "T002782", "T033203", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2024-27255" }, { "cve": "CVE-2023-26159", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in der Kernkomponente von MQ und sind auf Fehler im Bezug auf Buffer, Absicherung von Passw\u00f6rtern und Open Redirects zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T033842", "T033810", "T024690", "T002782", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-26159" }, { "cve": "CVE-2023-47745", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in der Kernkomponente von MQ und sind auf Fehler im Bezug auf Buffer, Absicherung von Passw\u00f6rtern und Open Redirects zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T033842", "T033810", "T024690", "T002782", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2023-47745" }, { "cve": "CVE-2024-25016", "notes": [ { "category": "description", "text": "In IBM MQ existieren mehrere Schwachstellen. Diese bestehen in der Kernkomponente von MQ und sind auf Fehler im Bezug auf Buffer, Absicherung von Passw\u00f6rtern und Open Redirects zur\u00fcckzuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren oder Informationen offenzulegen." } ], "product_status": { "known_affected": [ "T033842", "T033810", "T024690", "T002782", "T033811", "T015789", "T033537", "T033812", "T033681", "T018186", "T033332", "T015792", "T021621", "T019402", "T024689", "T019704", "5104", "T025159", "T023373" ] }, "release_date": "2024-02-29T23:00:00Z", "title": "CVE-2024-25016" } ] }
wid-sec-w-2024-0333
Vulnerability from csaf_certbund
Published
2024-02-08 23:00
Modified
2024-04-11 22:00
Summary
Red Hat Enterprise Linux (libmaxminddb): Schwachstelle ermöglicht Denial of Service
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in "libmaxminddb" ausnutzen, um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Red Hat Enterprise Linux (RHEL) ist eine popul\u00e4re Linux-Distribution.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux in \"libmaxminddb\" ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-0333 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0333.json" }, { "category": "self", "summary": "WID-SEC-2024-0333 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0333" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0768 vom 2024-02-12", "url": "https://linux.oracle.com/errata/ELSA-2024-0768.html" }, { "category": "external", "summary": "Rocky Linux Security Advisory RLSA-2024:0768 vom 2024-03-12", "url": "https://errata.build.resf.org/RLSA-2024:0768" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0750 vom 2024-02-08", "url": "https://access.redhat.com/errata/RHSA-2024:0750" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0751 vom 2024-02-08", "url": "https://access.redhat.com/errata/RHSA-2024:0751" }, { "category": "external", "summary": "Red Hat Bugzilla \u2013 Bug 1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0768 vom 2024-02-12", "url": "https://access.redhat.com/errata/RHSA-2024:0768" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:1686 vom 2024-04-04", "url": "https://access.redhat.com/errata/RHSA-2024:1686" }, { "category": "external", "summary": "IBM Security Bulletin 7148094 vom 2024-04-11", "url": "https://www.ibm.com/support/pages/node/7148094" } ], "source_lang": "en-US", "title": "Red Hat Enterprise Linux (libmaxminddb): Schwachstelle erm\u00f6glicht Denial of Service", "tracking": { "current_release_date": "2024-04-11T22:00:00.000+00:00", "generator": { "date": "2024-04-12T10:36:01.859+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2024-0333", "initial_release_date": "2024-02-08T23:00:00.000+00:00", "revision_history": [ { "date": "2024-02-08T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-02-11T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-02-12T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-03-12T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen" }, { "date": "2024-04-04T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-04-11T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "6" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "7.5", "product": { "name": "IBM QRadar SIEM 7.5", "product_id": "T022954", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5" } } } ], "category": "product_name", "name": "QRadar SIEM" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "RESF Rocky Linux", "product": { "name": "RESF Rocky Linux", "product_id": "T032255", "product_identification_helper": { "cpe": "cpe:/o:resf:rocky_linux:-" } } } ], "category": "vendor", "name": "RESF" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } }, { "category": "product_version", "name": "8", "product": { "name": "Red Hat Enterprise Linux 8", "product_id": "T032644", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8" } } }, { "category": "product_version", "name": "8.6", "product": { "name": "Red Hat Enterprise Linux 8.6", "product_id": "T032645", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8.6" } } }, { "category": "product_version", "name": "8.8", "product": { "name": "Red Hat Enterprise Linux 8.8", "product_id": "T032646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8.8" } } } ], "category": "product_name", "name": "Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "Container Platform 4.10", "product": { "name": "Red Hat OpenShift Container Platform 4.10", "product_id": "T025742", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.10" } } }, { "category": "product_version", "name": "Container Platform 4.11", "product": { "name": "Red Hat OpenShift Container Platform 4.11", "product_id": "T025990", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.11" } } }, { "category": "product_version", "name": "Container Platform 4.12", "product": { "name": "Red Hat OpenShift Container Platform 4.12", "product_id": "T026435", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.12" } } }, { "category": "product_version", "name": "Container Platform 4.9", "product": { "name": "Red Hat OpenShift Container Platform 4.9", "product_id": "T033901", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:container_platform_4.9" } } } ], "category": "product_name", "name": "OpenShift" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-28241", "notes": [ { "category": "description", "text": "Es besteht eine Schwachstelle in Red Hat Enterprise Linux. Dieser Fehler besteht in der Komponente libmaxminddb aufgrund eines unsachgem\u00e4\u00dfen Initialisierungsproblems. Durch Senden einer speziell gestalteten MaxMind DB-Datei, die von einer mit libmaxminddb verkn\u00fcpften Anwendung geparst wird, kann ein entfernter, anonymer Angreifer diese Schwachstelle ausnutzen, um einen Denial-of-Service-Zustand zu verursachen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion." } ], "product_status": { "known_affected": [ "T022954", "T032644", "T033901", "67646", "T032645", "T032646", "T025742", "T026435", "T004914", "T025990", "T032255" ] }, "release_date": "2024-02-08T23:00:00Z", "title": "CVE-2020-28241" } ] }
rhsa-2024_1686
Vulnerability from csaf_redhat
Published
2024-04-04 21:32
Modified
2024-11-15 21:13
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 for OpenShift image security update
Notes
Topic
A new image is available for Red Hat Single Sign-On 7.6.7, running on OpenShift Container Platform 3.10 and 3.11, and 4.3.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The rh-sso-7/sso76-openshift-rhel8 container image has been updated for RHEL-8 based Middleware Containers to address the following security advisory: RHSA-2023:5837 (see References)
Users of rh-sso-7/sso76-openshift-rhel8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.
Security Fix(es):
* pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)
* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)
* nss: vulnerable to Minerva side-channel information leak (CVE-2023-6135)
You can find images updated by this advisory in Red Hat Container Catalog (see References).
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A new image is available for Red Hat Single Sign-On 7.6.7, running on OpenShift Container Platform 3.10 and 3.11, and 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The rh-sso-7/sso76-openshift-rhel8 container image has been updated for RHEL-8 based Middleware Containers to address the following security advisory: RHSA-2023:5837 (see References)\n\nUsers of rh-sso-7/sso76-openshift-rhel8 container images are advised to upgrade to these updated images, which contain backported patches to correct these security issues, fix these bugs and add these enhancements. Users of these images are also encouraged to rebuild all container images that depend on these images.\n\nSecurity Fix(es):\n\n* pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE (CVE-2024-1597)\n\n* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)\n\n* nss: vulnerable to Minerva side-channel information leak (CVE-2023-6135)\n\nYou can find images updated by this advisory in Red Hat Container Catalog (see References).", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:1686", "url": "https://access.redhat.com/errata/RHSA-2024:1686" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2023:5837", "url": "https://access.redhat.com/errata/RHSA-2023:5837" }, { "category": "external", "summary": "https://catalog.redhat.com/software/containers/registry/registry.access.redhat.com/repository/rh-sso-7/sso76-openshift-rhel8", "url": "https://catalog.redhat.com/software/containers/registry/registry.access.redhat.com/repository/rh-sso-7/sso76-openshift-rhel8" }, { "category": "external", "summary": "1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "external", "summary": "2249906", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249906" }, { "category": "external", "summary": "2266523", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266523" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1686.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 for OpenShift image security update", "tracking": { "current_release_date": "2024-11-15T21:13:46+00:00", "generator": { "date": "2024-11-15T21:13:46+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2024:1686", "initial_release_date": "2024-04-04T21:32:08+00:00", "revision_history": [ { "date": "2024-04-04T21:32:08+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-04-04T21:32:08+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T21:13:46+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Middleware Containers for OpenShift", "product": { "name": "Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhosemc:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "product": { "name": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "product_id": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "product_identification_helper": { "purl": "pkg:oci/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso7-rhel8-operator-bundle\u0026tag=7.6.7-4" } } }, { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-42" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-42" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-42" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64 as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64" }, "product_reference": "rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64 as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x", "relates_to_product_reference": "8Base-RHOSE-Middleware" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-28241", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-11-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1895379" } ], "notes": [ { "category": "description", "text": "An improper initialization issue was found in libmaxminddb. A remote user could exploit this flaw by sending a specially crafted MaxMind DB file that, when parsed by an application linked to libmaxminddb, would possibly crash the application, resulting in a denial of service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28241" }, { "category": "external", "summary": "RHBZ#1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28241", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28241" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241" } ], "release_date": "2020-08-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-04-04T21:32:08+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1686" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c" }, { "cve": "CVE-2023-6135", "cwe": { "id": "CWE-200", "name": "Exposure of Sensitive Information to an Unauthorized Actor" }, "discovery_date": "2023-11-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2249906" } ], "notes": [ { "category": "description", "text": "The Network Security Services (NSS) package contains a vulnerability that exposes a side-channel information leak. This weakness enables a local attacker to capture several thousand usages of a signature, allowing them to utilize this information to recover portions of an ECDSA private key.", "title": "Vulnerability description" }, { "category": "summary", "text": "nss: vulnerable to Minerva side-channel information leak", "title": "Vulnerability summary" }, { "category": "other", "text": "The severity of the Network Security Services (NSS) package vulnerability is marked as moderate due to the inherent risk associated with a potential side-channel information leak. This flaw empowers a local attacker to capture a substantial volume of signature usages, providing a pathway for them to exploit this data to reconstruct portions of an ECDSA private key. The ECDSA private key is a fundamental component of cryptographic security, and a successful compromise could have severe implications for the confidentiality and integrity of sensitive information.\n\nThe side channel present in NSS is on the order of 20 to 50ns, measuring such small differences over the network, without ability to measure signature with the same nonce is not something anybody has shown as possible. The only reason we can measure such small differences in the Marvin attack (https://people.redhat.com/~hkario/marvin/) is because the attacker there has full control over the processed messages, as such can measure the same message over and over, with ECDSA NSS is generating the used nonce randomly, and internally, for each and every signature. So a possibility of a purely network attack is rather theoretical at this moment.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-6135" }, { "category": "external", "summary": "RHBZ#2249906", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2249906" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-6135", "url": "https://www.cve.org/CVERecord?id=CVE-2023-6135" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-6135", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6135" }, { "category": "external", "summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=1853908", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1853908" }, { "category": "external", "summary": "https://minerva.crocs.fi.muni.cz/", "url": "https://minerva.crocs.fi.muni.cz/" }, { "category": "external", "summary": "https://people.redhat.com/~hkario/marvin/", "url": "https://people.redhat.com/~hkario/marvin/" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-56/#CVE-2023-6135", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2023-56/#CVE-2023-6135" } ], "release_date": "2023-12-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-04-04T21:32:08+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1686" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nss: vulnerable to Minerva side-channel information leak" }, { "cve": "CVE-2024-1597", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)" }, "discovery_date": "2024-02-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2266523" } ], "notes": [ { "category": "description", "text": "A flaw was found in the PostgreSQL JDBC Driver. A SQL injection is possible when using the non-default connection property preferQueryMode=simple in combination with application code that has a vulnerable SQL that negates a parameter value.", "title": "Vulnerability description" }, { "category": "summary", "text": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "title": "Vulnerability summary" }, { "category": "other", "text": "The PostgreSQL JDBC Driver is not affected in the default query mode. Users that do not override the query mode are not impacted.\n\nThe described SQL injection vulnerability, while significant, is categorized as important rather than critical due to several factors. Firstly, the exploitation relies on specific conditions, including the use of a non-default query mode (preferQueryMode=simple) and the precise arrangement of user-controlled parameters within the SQL query. This limits the potential attack surface and reduces the likelihood of widespread exploitation across systems. Additionally, the vulnerability does not pose an immediate and severe risk of system compromise or data breach; rather, it enables attackers to manipulate SQL queries and potentially execute arbitrary commands within the context of the application\u0027s database. Furthermore, the vulnerability can be effectively mitigated by applying the provided patch or by avoiding the use of the vulnerable query mode, thus reducing the risk of exploitation.\n\nRed Hat Satellite ships a PostgreSQL JDBC Driver which embeds into Candlepin. However, Candlepin doesn\u0027t directly utilize the PostgreSQL JDBC Driver and doesn\u0027t set PreferQueryMode. Therefore, although the affected component is shipped, the product impact is considered Low. This issue may be addressed in a future Satellite release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2024-1597" }, { "category": "external", "summary": "RHBZ#2266523", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2266523" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2024-1597", "url": "https://www.cve.org/CVERecord?id=CVE-2024-1597" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-1597", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1597" }, { "category": "external", "summary": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56", "url": "https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-24rp-q3w6-vc56" }, { "category": "external", "summary": "https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/", "url": "https://www.enterprisedb.com/docs/jdbc_connector/latest/01_jdbc_rel_notes/" }, { "category": "external", "summary": "https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/", "url": "https://www.enterprisedb.com/docs/security/assessments/cve-2024-1597/" } ], "release_date": "2024-02-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-04-04T21:32:08+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:1686" }, { "category": "workaround", "details": "Do not use the connection propertypreferQueryMode=simple. If you do not explicitly specify a query mode, then you are using the default of extended and are not impacted by this issue.", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso7-rhel8-operator-bundle@sha256:fa9d954957c644853886943a2bb5e18b178f3595384bdb73b8e5f7e5db0f4932_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:89f7ae83a1818e771e20982a6a4dd2c01ded703c65e90263f961504a3d1c5b37_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:c70d15537cad829f067e8c6ad57dfe5300fd9ff768d27973354bb061cae7754b_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:efe74faab04366421442d5febdc4087aece4506a92c0ba1be42fe627a23fb0cb_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE" } ] }
rhsa-2024_0751
Vulnerability from csaf_redhat
Published
2024-02-08 18:10
Modified
2024-11-06 04:59
Summary
Red Hat Security Advisory: libmaxminddb security update
Notes
Topic
An update for libmaxminddb is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The libmaxminddb package contains the MaxMind DB library.
Security Fix(es):
* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for libmaxminddb is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The libmaxminddb package contains the MaxMind DB library.\n\nSecurity Fix(es):\n\n* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:0751", "url": "https://access.redhat.com/errata/RHSA-2024:0751" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0751.json" } ], "title": "Red Hat Security Advisory: libmaxminddb security update", "tracking": { "current_release_date": "2024-11-06T04:59:07+00:00", "generator": { "date": "2024-11-06T04:59:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:0751", "initial_release_date": "2024-02-08T18:10:05+00:00", "revision_history": [ { "date": "2024-02-08T18:10:05+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-02-08T18:10:05+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:59:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.6::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_6.1.src", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.src", "product_id": "libmaxminddb-0:1.2.0-10.el8_6.1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_6.1?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "product_id": "libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_6.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_6.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_6.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_6.1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "product_id": "libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_6.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_6.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_6.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_6.1?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_6.1.i686", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.i686", "product_id": "libmaxminddb-0:1.2.0-10.el8_6.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_6.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_6.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_6.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_6.1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "product_id": "libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_6.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_6.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_6.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_6.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "product_id": "libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_6.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_6.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_6.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_6.1?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.aarch64" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.i686" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_6.1.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.s390x" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.src" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_6.1.src", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.x86_64" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.6)", "product_id": "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64", "relates_to_product_reference": "AppStream-8.6.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-28241", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-11-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1895379" } ], "notes": [ { "category": "description", "text": "An improper initialization issue was found in libmaxminddb. A remote user could exploit this flaw by sending a specially crafted MaxMind DB file that, when parsed by an application linked to libmaxminddb, would possibly crash the application, resulting in a denial of service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.src", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28241" }, { "category": "external", "summary": "RHBZ#1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28241", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28241" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241" } ], "release_date": "2020-08-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-02-08T18:10:05+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.src", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0751" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.src", "AppStream-8.6.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_6.1.x86_64", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.aarch64", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.i686", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.ppc64le", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.s390x", "AppStream-8.6.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_6.1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c" } ] }
rhsa-2024_0750
Vulnerability from csaf_redhat
Published
2024-02-08 18:08
Modified
2024-11-06 04:58
Summary
Red Hat Security Advisory: libmaxminddb security update
Notes
Topic
An update for libmaxminddb is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The libmaxminddb package contains the MaxMind DB library.
Security Fix(es):
* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for libmaxminddb is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The libmaxminddb package contains the MaxMind DB library.\n\nSecurity Fix(es):\n\n* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:0750", "url": "https://access.redhat.com/errata/RHSA-2024:0750" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0750.json" } ], "title": "Red Hat Security Advisory: libmaxminddb security update", "tracking": { "current_release_date": "2024-11-06T04:58:57+00:00", "generator": { "date": "2024-11-06T04:58:57+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:0750", "initial_release_date": "2024-02-08T18:08:29+00:00", "revision_history": [ { "date": "2024-02-08T18:08:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-02-08T18:08:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:58:57+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product": { "name": "Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_eus:8.8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_8.1.src", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.src", "product_id": "libmaxminddb-0:1.2.0-10.el8_8.1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_8.1?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "product_id": "libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_8.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_8.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_8.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_8.1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "product_id": "libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_8.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_8.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_8.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_8.1?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_8.1.i686", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.i686", "product_id": "libmaxminddb-0:1.2.0-10.el8_8.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_8.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_8.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_8.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_8.1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "product_id": "libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_8.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_8.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_8.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_8.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "product_id": "libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_8.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_8.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_8.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_8.1?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.aarch64" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.i686" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_8.1.i686", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.s390x" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.src as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.src" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_8.1.src", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.x86_64" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.8.8)", "product_id": "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64", "relates_to_product_reference": "AppStream-8.8.0.Z.EUS" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-28241", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-11-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1895379" } ], "notes": [ { "category": "description", "text": "An improper initialization issue was found in libmaxminddb. A remote user could exploit this flaw by sending a specially crafted MaxMind DB file that, when parsed by an application linked to libmaxminddb, would possibly crash the application, resulting in a denial of service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.src", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28241" }, { "category": "external", "summary": "RHBZ#1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28241", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28241" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241" } ], "release_date": "2020-08-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-02-08T18:08:29+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.src", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0750" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.src", "AppStream-8.8.0.Z.EUS:libmaxminddb-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-debuginfo-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-debugsource-0:1.2.0-10.el8_8.1.x86_64", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.aarch64", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.i686", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.ppc64le", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.s390x", "AppStream-8.8.0.Z.EUS:libmaxminddb-devel-0:1.2.0-10.el8_8.1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c" } ] }
rhsa-2024_0768
Vulnerability from csaf_redhat
Published
2024-02-12 00:33
Modified
2024-11-06 04:59
Summary
Red Hat Security Advisory: libmaxminddb security update
Notes
Topic
An update for libmaxminddb is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The libmaxminddb package contains the MaxMind DB library.
Security Fix(es):
* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for libmaxminddb is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The libmaxminddb package contains the MaxMind DB library.\n\nSecurity Fix(es):\n\n* libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2024:0768", "url": "https://access.redhat.com/errata/RHSA-2024:0768" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0768.json" } ], "title": "Red Hat Security Advisory: libmaxminddb security update", "tracking": { "current_release_date": "2024-11-06T04:59:21+00:00", "generator": { "date": "2024-11-06T04:59:21+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2024:0768", "initial_release_date": "2024-02-12T00:33:22+00:00", "revision_history": [ { "date": "2024-02-12T00:33:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2024-02-12T00:33:22+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-06T04:59:21+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_9.1.src", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.src", "product_id": "libmaxminddb-0:1.2.0-10.el8_9.1.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_9.1?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "product_id": "libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_9.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_9.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_9.1?arch=aarch64" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_9.1?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "product_id": "libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_9.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_9.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_9.1?arch=ppc64le" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_9.1?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_9.1.i686", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.i686", "product_id": "libmaxminddb-0:1.2.0-10.el8_9.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_9.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_9.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_9.1?arch=i686" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_9.1?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "product_id": "libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_9.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_9.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_9.1?arch=x86_64" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_9.1?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "product": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "product_id": "libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb@1.2.0-10.el8_9.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "product": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "product_id": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-devel@1.2.0-10.el8_9.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "product": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "product_id": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debugsource@1.2.0-10.el8_9.1?arch=s390x" } } }, { "category": "product_version", "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "product": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "product_id": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/libmaxminddb-debuginfo@1.2.0-10.el8_9.1?arch=s390x" } } } ], "category": "architecture", "name": "s390x" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.aarch64" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.i686" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_9.1.i686", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.s390x" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.src" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_9.1.src", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-0:1.2.0-10.el8_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.x86_64" }, "product_reference": "libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64" }, "product_reference": "libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64" }, "product_reference": "libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" }, { "category": "default_component_of", "full_product_name": { "name": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64" }, "product_reference": "libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64", "relates_to_product_reference": "AppStream-8.9.0.Z.MAIN" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-28241", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "discovery_date": "2020-11-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1895379" } ], "notes": [ { "category": "description", "text": "An improper initialization issue was found in libmaxminddb. A remote user could exploit this flaw by sending a specially crafted MaxMind DB file that, when parsed by an application linked to libmaxminddb, would possibly crash the application, resulting in a denial of service condition.", "title": "Vulnerability description" }, { "category": "summary", "text": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.src", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-28241" }, { "category": "external", "summary": "RHBZ#1895379", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895379" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28241", "url": "https://www.cve.org/CVERecord?id=CVE-2020-28241" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241" } ], "release_date": "2020-08-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2024-02-12T00:33:22+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.src", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2024:0768" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.src", "AppStream-8.9.0.Z.MAIN:libmaxminddb-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debuginfo-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-debugsource-0:1.2.0-10.el8_9.1.x86_64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.aarch64", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.i686", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.ppc64le", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.s390x", "AppStream-8.9.0.Z.MAIN:libmaxminddb-devel-0:1.2.0-10.el8_9.1.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c" } ] }
gsd-2020-28241
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2020-28241", "description": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.", "id": "GSD-2020-28241", "references": [ "https://www.suse.com/security/cve/CVE-2020-28241.html", "https://ubuntu.com/security/CVE-2020-28241", "https://advisories.mageia.org/CVE-2020-28241.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-28241" ], "details": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.", "id": "GSD-2020-28241", "modified": "2023-12-13T01:22:01.378965Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-28241", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/maxmind/libmaxminddb/issues/236", "refsource": "MISC", "url": "https://github.com/maxmind/libmaxminddb/issues/236" }, { "name": "https://github.com/maxmind/libmaxminddb/pull/237", "refsource": "MISC", "url": "https://github.com/maxmind/libmaxminddb/pull/237" }, { "name": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3", "refsource": "MISC", "url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3" }, { "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2445-1] libmaxminddb security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html" }, { "name": "GLSA-202011-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/202011-15" }, { "name": "FEDORA-2020-1fb1785fa1", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/" }, { "name": "FEDORA-2020-8a8f8b244f", "refsource": "FEDORA", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:maxmind:libmaxminddb:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "1.4.3", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-28241" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-125" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/maxmind/libmaxminddb/issues/236", "refsource": "MISC", "tags": [ "Exploit", "Patch", "Third Party Advisory" ], "url": "https://github.com/maxmind/libmaxminddb/issues/236" }, { "name": "https://github.com/maxmind/libmaxminddb/pull/237", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/maxmind/libmaxminddb/pull/237" }, { "name": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3" }, { "name": "[debian-lts-announce] 20201110 [SECURITY] [DLA 2445-1] libmaxminddb security update", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html" }, { "name": "GLSA-202011-15", "refsource": "GENTOO", "tags": [ "Third Party Advisory" ], "url": "https://security.gentoo.org/glsa/202011-15" }, { "name": "FEDORA-2020-8a8f8b244f", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG/" }, { "name": "FEDORA-2020-1fb1785fa1", "refsource": "FEDORA", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV/" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 3.6 } }, "lastModifiedDate": "2022-01-06T14:18Z", "publishedDate": "2020-11-06T05:15Z" } } }
ghsa-8h2q-prr9-7wh9
Vulnerability from github
Published
2022-05-24 17:33
Modified
2022-05-24 17:33
Details
libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.
{ "affected": [], "aliases": [ "CVE-2020-28241" ], "database_specific": { "cwe_ids": [ "CWE-125", "CWE-787" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2020-11-06T05:15:00Z", "severity": "MODERATE" }, "details": "libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.", "id": "GHSA-8h2q-prr9-7wh9", "modified": "2022-05-24T17:33:20Z", "published": "2022-05-24T17:33:20Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28241" }, { "type": "WEB", "url": "https://github.com/maxmind/libmaxminddb/issues/236" }, { "type": "WEB", "url": "https://github.com/maxmind/libmaxminddb/pull/237" }, { "type": "WEB", "url": "https://github.com/maxmind/libmaxminddb/compare/1.4.2...1.4.3" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00019.html" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6WUK4UCOB5FJVK36E22IRLEYGKMUWGBG" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ELTOHZBPO6XVUVADP4DPZBNQCPTYOQBV" }, { "type": "WEB", "url": "https://security.gentoo.org/glsa/202011-15" } ], "schema_version": "1.4.0", "severity": [] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.